Messages in console from syslog

[R.O.]

Hi,

I am receiving in the console messages like this:

May 18 13:02:02 system1 syslogd: syslog/udp: unknown service

The syslogd daemon is running and is working, because I have the normal entries in syslog.log. Does anybody know why this message appears?

Regards,

[Steven E. Protter · Accepted solution]

Shalom,

I would first check the syslog.conf file and see if someone is trying to redirect a copy of syslog output to another server. This being done without a supporting entry in /etc/services could cause the problem.

SEP

[R.O.]

Hello!

Here is syslog.conf:

# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

In /etc/services the line for syslog is commented:

#syslog 514/udp # remote system logging

Regards,

[Ninad_1]

I do not feel from your syslog.conf file that any remote syslog is being used (If thats the complete file you have pasted)
Try commenting out i.e. remove the # before the syslog in /etc/services file and see if there are no more messages of unknown service.

Regards,
Ninad

[R.O.]

Hi,

This is the entire syslog.conf. I have the same commented line in other nodes, and no messages appear on them.
Regards,

[Bill Hassell]

The syslog.conf file only controls what the local machine does with syslog entries. If another computer is using your local syslog, there will be an additional field with the hostname in each of those log entries.

The /etc/services file is your problem. The comment in front of syslog means that there is no name for the syslog service. In this case, it only produces an extraneous error message. Take away the # in the first column, restart syslogd and the error messages will go away. Other network services may crash if there the program requires a service name in /etc/services.

To restart syslogd:

kill -HUP $(cat /var/run/syslog.pid)

[R.O.]

Thank you ! It was the entry /etc/services, after patch the system.