MonitorWare Knowledge Base

[madmax]

Hi all,

i have one question:
a friend will send his syslog-messages (from his router) over the internet to my redhat-server but i didn't see any request on my firewall .

so the question....
is it possible to send this syslog-messages over the internet? (not into the privat network).

are there some hints for this architecture?

the redhat-server is listen on upd/514 is this correct, or have i forgot something?

thx for help
madmax

[rgerhards]

Hi,

syslog is just a "normal" TCP applicaton, so you can use the Internet or Intranet as you like. You just must be aware that a third party can intercept the syslog message. As they are plain text, this may reveal information you would not really like an outsider to see. Also, UDP is lossy transport, so not all packets may arrive at your server (if the Internet is very busy). But besides this, using syslog over the Internet is possible and I know of at least some who have done so successfully.

I guess that you do not see anything on the red hat box is a config issue. The syslogd must be instructed to accept remote messages. By default, it logs only local message. AFAIK, you need to specify the "-r" option with syslogd. If in doubt, see the syslogd man page.

Hope this helps,
Rainer

[madmax]

hi

thx for the fast answer:
to syslog-config: i am using syslog-ng and listening on upd-port 514

but i think the problem is not syslog, i think its the tcp connection.

when i sniff (tcpdump -i eth0 host xxx.xxx.xxx) i dont see anything from the router.... so therefor i thought there is a restiction for syslog-forward...

[rgerhards]

Hi,

this looks like either the ISP block syslog (can happen with ISPs...), or the router itself does not forward to the Internet interface (I personally have yet to see this, but it might exist...).

Rainer