docs/161129: syslog does not accept remote host logs

[Andrei Kolu]

>Number:         161129
>Category:       docs
>Synopsis:       syslog does not accept remote host logs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-doc
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Thu Sep 29 17:40:07 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Andrei Kolu
>Release:        9-BETA2
>Organization:
Raidon Raalid OÜ
>Environment:
FreeBSD drak 9.0-BETA2 FreeBSD 9.0-BETA2 #1: Mon Sep  5 00:23:25 EEST 2011     root at drak:/usr/obj/usr/src/sys/DRAK  amd64

>Description:
If I configure syslog for remote logging according to this manual:
http://www.freebsd.org/doc/handbook/network-syslogd.html

####hosts file
10.10.10.1 cisco1812 cisco1812.example.com

####rc.conf
syslogd_enable="YES"
syslogd_flags="-d -a 10.10.10.1 -v -v"

####syslog.conf
# Logging cisco
+cisco1812.example.com
*.* /var/log/cisco1812.example.com.log

then syslog would give me this error:

"validate: dgram from IP 10.10.10.1, port 54446, name cisco1812.example.com;
rejected in rule 0 due to port mismatch."


>How-To-Repeat:
####rc.conf
syslogd_enable="YES"
syslogd_flags="-d -a 10.10.10.1 -v -v"

####syslog.conf
# Logging cisco
+cisco1812.example.com
*.* /var/log/cisco1812.example.com.log

restart syslogd
>Fix:
####rc.conf
syslogd_enable="YES"
syslogd_flags="-a 10.10.10.1:* -v -v"

####syslog.conf
# Logging cisco
+cisco1812.example.com
*.* /var/log/cisco1812.example.com.log

restart syslogd

validate: dgram from IP 10.10.10.1, port 54446, name cisco1812.example.com;
accepted in rule 0.

>Release-Note:
>Audit-Trail:
>Unformatted: