On Fri, Oct 28, 2011 at 8:37 PM, Larry Rosenman <ler_at_lerctr.org> wrote: > On Fri, 28 Oct 2011, Kevin Oberman wrote: > >> On Fri, Oct 28, 2011 at 7:22 PM, Larry Rosenman <ler_at_lerctr.org> wrote: >>> >>> I enabled remote logging for my home subnet, and syslogd doesn't seem(!) >>> to >>> be logging the messages. >>> >>> They ARE making it to the system. >>> >>> Can someone look at bin/162135 which has all the details, including >>> tcpdump to show that the messages are making it to the system. >> >> Just to be clear, you are running tcpdump on borg, right? The >> statement "This is from my Cable Modem:" confuses me a bit. > > Yes, the tcpdump is running on borg, and the source of the syslog packets > is from my Cable Modem at 192.168.200.10. > > /etc/hosts.allow: [Comments elided] > ALL : PARANOID : RFC931 20 : deny > ALL : localhost 127.0.0.1 : allow > ALL : [::1] : allow > exim : localhost : allow > exim : ALL : allow > rpcbind : ALL : deny > ypserv : localhost : allow > ypserv : ALL : deny > ftpd : localhost : allow > ftpd : ALL : allow > fingerd : ALL \ > : spawn (echo Finger. | \ > /usr/bin/mail -s "tcpd\: %u_at_%h[%a] fingered me!" root) & \ > : deny Several superfluous rules, but I can't see anything that would block 514. >> >> Assuming tcpdump is on borg, it is making past any firewall (pf or >> ipfw, at least). What about /etc/hosts.allow? I don't recall if it >> filters before or after pcap see packets. I used to have a diagram >> showing the sequence of processing this, but I can't seem to find it >> now. >> >> What does "netstat -af inet | grep syslog" show? Is syslogd actually >> listening? > > > the netstat output: udp4 0 0 *.syslog *.* > > and sockstat | grep syslog: root syslogd 65128 4 dgram /var/run/log > root syslogd 65128 5 dgram /var/run/logpriv > root syslogd 65128 6 udp6 *:514 *:* > root syslogd 65128 7 udp4 *:514 *:* OK. I'm baffled! I can't see anything that looks wrong, but I'll think about it a bit more. -- R. Kevin Oberman, Network Engineer E-mail: kob6558_at_gmail.comReceived on Sat Oct 29 2011 - 02:16:29 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:19 UTC