syslog listening port

[Dooling37]

hey all,

anyone know how to change the port that syslog listens on on a Nix box (e.g., from 514/udp --> 10514/udp)? I would've thought /etc/syslog.conf, but it appears not. I've also checked /etc/rc.d/init.d/syslogd, to no avail.

any assistance would be appreciated...

 

[n0cmonkey]

Which syslogd?

 

[Dooling37]

hmm, don't know unfortunately (trying to assist a friend remotely). is there any easy way that I could get him to find out?

I do know that he's running syslog with came installed with RedHat (9.0, I *think*). does that help?


thanks..

 

[n0cmonkey]

You could try:
Change the syslog entry in /etc/services.
Forward 10514 using ipchains/iptables to 514.

Why does he want this changed? 514 is the syslog port, it's where it should be.

 

[Dooling37]

I'll suggest the firewall port forwarding idea, thanks.

I don't think editing /etc/services would actually change local service ports, but I could be wrong.

Needs to change the syslog port for a custom application. Ports are not set in stone.

 

[n0cmonkey]

Originally posted by: Dooling37
I'll suggest the firewall port forwarding idea, thanks.

I don't think editing /etc/services would actually change local service ports, but I could be wrong.

I'd agree, but the following quote made me think it could be worth trying:

To have this work correctly the services(5) files (typically found in /etc) must have the following entry:
syslog 514/udp
If this entry is missing syslogd neither can receive remote messages nor send them, because the UDP port cant be opened. Instead syslogd will die immediately, blowing out an error message.

Needs to change the syslog port for a custom application. Ports are not set in stone.

No, but standards are nice. It's how we interoperate. 🙂

Maybe his custom application should use the right port. 😉

 

[Nothinman]

I don't think editing /etc/services would actually change local service ports, but I could be wrong.

Depends on how the syslog daemon determins what port to open. It's possible that the daemon calls getservbyname(syslog, udp) and then listen()s on the port number it returned.

Needs to change the syslog port for a custom application. Ports are not set in stone.

Tell him to yell at the people who wrote the custom application.

 

[Dooling37]

Originally posted by: n0cmonkey

No, but standards are nice. It's how we interoperate. 🙂

Maybe his custom application should use the right port. 😉

Points taken. ; )

Thanks again for the advice. If I hear back, I'll post whether or not he successfully made this change..