syslog - loghost

[Nobody's Hero]

I am trying to get my system to talk on 514 so the loghost setup will work.
I get this:

#telnet localhost 514
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused

/etc/services looks good.
/etc/syslog.conf looks good.

not sure what else to check. I am using tcp wrappers....

[Nobody's Hero]

cant get 514 to listen:

#netstat -anf inet | grep 514
*.514 Idle

[Matti_Kurkela]

Syslog uses UDP, not TCP.

Only TCP services can be tested with telnet.

Use the "logger" command to test syslog transmission over the network.

MK

[Nobody's Hero]

I guess I am more concerned why I cant telnet to localhost 514.

I've been working on this all day.
On one box Iget this:

#telnet localhost 514
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection to localhost closed by foreign host.

on the problem box, I get this:
# telnet localhost 514
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused

I just cant figure it out, whats stopping it.

[Matti_Kurkela · Accepted solution]

514/UDP is syslog, while 514/TCP is remshd service. See "grep 514 /etc/services" and cross-reference to /etc/inetd.conf.

Apparently your problem host has remshd service completely disabled, while the other has it enabled (although possibly protected with a tcpwrapper: a connection that closes immediately after opening is the signature of tcpwrapper rejecting a connection).

The (in-)ability to telnet to port 514/TCP is completely unrelated to the functioning of syslog at 514/UDP.

The TCP and UDP protocols don't share a port number space: both protocols have completely independent sets of 65535 port numbers, although some protocols have been assigned both types of ports for historical reasons (see /etc/services for examples).

The most critical log messages are often something like "HELP! I'm crashing because of X". In a situation like that, the most important thing is to get the message out as quickly as possible, while the system still can do it.

TCP requires a three-way handshake for establishing a connection, which is less than ideal for logging. Syslog is a connectionless "fire-and-forget" protocol, which requires the use of UDP.

MK