Re: log server

[Mike Fedyk <mfedyk@matchmail.com>]

On Tue, May 15, 2001 at 09:52:25PM -0500, ktb wrote:
> On Tue, May 15, 2001 at 09:50:39PM -0500, Bryan Andersen wrote:
> > ktb wrote:
> > > 
> > > I've set up a log server, which I fire up as -
> > > /sbin/syslogd -r
> > > 
> > > The machine I'm logging from I've recompiled Debian source and pointed it
> > > to a different syslog.conf file.  I've got it set up to log as normal
> > > but also log to the server, with the following -
> > > *.*             @host
> > 
> > So your loghost machine is "host"?
> > 
> > Try looking at the logs on the source machine.  Look for error 
> > lines from syslogd.
> > 
> 
> No the real name isn't "host" but the line points to the log server.
> 
> No errors in the logs.  Everything is being logged as normal to console
> and the log files.  Just not fully logging to the remote log server.
> Thanks,
> kent
> 
> 
Please use tcpdump to test to see if traffic is actually being generated.

(assuming eth0 is the right interface) that would be:

tcpdump -ni eth0 dst or src syslog and udp port 514

s/syslog/your host/g

Mike