Nov 11, 2019
Check out this blog to learn how to interpret and find systemd journals to troubleshoot problems in your Linux systems at http://bit.ly/2X3NbHZ
Loading...
seen from United States
seen from United States
seen from Germany
seen from Malaysia
seen from China
seen from T1
seen from India
seen from T1
seen from T1
seen from United Kingdom
seen from France
seen from United States
seen from United Kingdom
seen from United States
seen from China
seen from United States
seen from Russia
seen from Germany
seen from India
seen from Australia
Check out this blog to learn how to interpret and find systemd journals to troubleshoot problems in your Linux systems at http://bit.ly/2X3NbHZ
Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch • No registration required • HD streaming
Syslogd oddities #1: do not sync log file action
When a selector ( e.g. facility.priority ) has identified a message the next step is to take an action. Usually this is to write the message to a file. If the file name is preceded by a hyphen - then the file is not synced after each log action, e.g. see man -s 5 syslog.conf :
Actions The action field of a rule describes the abstract term ''logfile''. A ''logfile'' need not to be a real file, btw. The syslogd(8) provides the following actions. Regular File Typically messages are logged to real files. The file has to be specified with full pathname, beginning with a slash ''/''. You may prefix each entry with the minus ''-'' sign to omit syncing the file after every logging. Note that you might lose information if the system crashes right behind a write attempt. Nevertheless this might give you back some performance, especially if you run programs that use logging in a very verbose manner.
Are syslog sending applications allowed to use a source port of UDP/514?
An interesting question came up today: can syslog sending applications use UDP/514? Is that allowed? Are there any restrictions on what source port to use?
According to the RFC 5426, it's permitted.
Check out section 3.3:
3.3. Source and Target Ports
Syslog receivers MUST support accepting syslog datagrams on the well- known UDP port 514, but MAY be configurable to listen on a different port. Syslog senders MUST support sending syslog message datagrams to the UDP port 514, but MAY be configurable to send messages to a different port. Syslog senders MAY use any source UDP port for transmitting messages.
How to configure syslogd to send to multiple servers
In case someone else on the interwebs has a similar question/issue, here's how to configure syslogd to send to multiple downstream repositories:
1) Edit /etc/syslog.conf 2) Add multiple separate lines for each syslog facility you want to send traffic for. For example, if I want to send mail related events to a syslog server at 1.1.1.1 and a separate syslog server at 2.2.2.2, I would add two lines that read:
mail.* @1.1.1.1 mail.* @2.2.2.2
As a reminder, syslog facility names are defined here (in addition to the RFCs).