#syslogd

[adminondemand]

How to Analyze Systemd Journal Entry in Linux

Check out this blog to learn how to interpret and find systemd journals to troubleshoot problems in your Linux systems at http://bit.ly/2X3NbHZ

[ushf]

Syslogd oddities #1: do not sync log file action

When a selector ( e.g. facility.priority ) has identified a message the next step is to take an action. Usually this is to write the message to a file. If the file name is preceded by a hyphen - then the file is not synced after each log action, e.g. see man -s 5 syslog.conf :

Actions The action field of a rule describes the abstract term ''logfile''. A ''logfile'' need not to be a real file, btw. The syslogd(8) provides the following actions. Regular File Typically messages are logged to real files. The file has to be specified with full pathname, beginning with a slash ''/''. You may prefix each entry with the minus ''-'' sign to omit syncing the file after every logging. Note that you might lose information if the system crashes right behind a write attempt. Nevertheless this might give you back some performance, especially if you run programs that use logging in a very verbose manner.

[mikeberggren]

Are syslog sending applications allowed to use a source port of UDP/514?

An interesting question came up today: can syslog sending applications use UDP/514? Is that allowed? Are there any restrictions on what source port to use?

According to the RFC 5426, it's permitted.

Check out section 3.3:

3.3. Source and Target Ports

Syslog receivers MUST support accepting syslog datagrams on the well- known UDP port 514, but MAY be configurable to listen on a different port. Syslog senders MUST support sending syslog message datagrams to the UDP port 514, but MAY be configurable to send messages to a different port. Syslog senders MAY use any source UDP port for transmitting messages.

[mikeberggren]

How to configure syslogd to send to multiple servers

In case someone else on the interwebs has a similar question/issue, here's how to configure syslogd to send to multiple downstream repositories:

1) Edit /etc/syslog.conf 2) Add multiple separate lines for each syslog facility you want to send traffic for. For example, if I want to send mail related events to a syslog server at 1.1.1.1 and a separate syslog server at 2.2.2.2, I would add two lines that read:

mail.* @1.1.1.1 mail.* @2.2.2.2

As a reminder, syslog facility names are defined here (in addition to the RFCs).