CentOS Syslog Server Help
 

Not sure which forum this should be posted in so I'm just creating it in General.

I'm trying to setup a central syslog server on a CentOS 5.4 machine. I'm going to use it to store syslogs from a Cisco firewall. I'm still fairly new to linux and I can't get the logs to come through.

I'll post what change's/ addition I've made to config files, but not the entire config. Please let me know if you need more info to give me a hand. Here's what I've done so far:

- /etc/syslog.conf

# Log firewall messages
local4.* /var/log/firewall

-rw------- 1 root root 0 Dec 21 01:00 firewall

- /etc/sysconfig/syslog

SYSLOGD_OPTIONS="-m 0 -r -x"

- /etc/services

syslog 514/udp

- iptables -L
ACCEPT udp -- 192.168.20.8 192.168.21.177 udp dpt:syslog

- ps -ef | grep syslog

root 3372 1 0 11:49 ? 00:00:00 syslogd -m 0 -r -x


I've been searching on Google for ideas, but no luck. I can't figure out why nothing is getting logged to /var/log/firewall. I've checked the logging settings on the firewall and everything looks fine.

Those thund seem ok, but syslogd is pretty unhelpful for debugging things like this. Personally I would use tcpdump or wireshark to see if the traffic is hitting the machine in the first place. Being unidirectional udp though it won't really shed so much light on what iptables thinks about it compared to tcp.

Also you might wish to use a more user friendly syslig service, like syslog-ng which has a much nicer config and better debugging options.

Oh, and run 'netstat -plnu. To see if the service is indeed listening nicely on 514

Reply:installation syslog-ng server in centos
 

hi i'm trying to install the syslog-ng.3.2.4 in centos 5.6 but it doesn't work ,the syslog-ng can't start ,i would like to know if there if it's a problem of syslog-ng version ?there is a version compatible whit centos 5.6 or not?and where are u download your package?

please don't hijack other threads. This thread in't even about syslog-ng.