Syslog not writing to remote syslogd

[Craig A. Sharp]

Hi,

I am running an external syslogd program on my pc and trying to capture syslogs from two of my servers.

One of the servers works correctly and the logger on the pc is seeing the data. The other server is not sending the data to the logger on the pc. I am using identical syslog.conf files with no luck. I have restarted the syslog daemon on the non-working system several times.
Here is the syslog.conf file. The IP address of the logger is obscured.

# cat syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
*.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info @10.50.x.x

Thanks!

[Mark Greene_1]

On the server that is not working right, is port 514 open? Does netstat -a|grep 514 return anything? Does netstat -s return a high number of UDP errors compared to the working server?

mark

[Craig A. Sharp]

netstat -a -s not returning anything for 514 and there are no errors showing for udp.

[Craig A. Sharp]

Sorry, netstat -a is not returning anything for 514.

[Bill Douglass]

Do you have patch PHCO_27847 installed. This is the latest HP-UX 11.0 syslogd patch.

If not, try installing and restart syslogd again.


Also, syslogs does not open UDP port 514 unless it is listening for incomping syslog messages. If you started syslogd with the -N option, then it will not show up under port 514 in netstat, even though it is sending output to a remote host.

[Kenneth Penland]

I have had this happen to me before also. Even though a visual comparison of the syslog.conf file looked like they were both the same, it started working after we copied the one that worked over to the one that didn't...we just wrote it off as possibly there were spaces instead of tabs...or something like that. Prob not what your issue is, but its worth a shot...

[Craig A. Sharp]

Spaces and tabs were the problem. The copy changed the tabs to spaces.

Thanks to all who replied.