[rsyslog] directing logs to a broadcast address fails
Tom Metro
tmetro+rsyslog at gmail.com
Wed Apr 29 07:02:35 CEST 2009
I originally ran across an apparent bug in sysklogd where if you modify
your /etc/syslog.conf to have a line like:
*.crit @192.168.0.255
restart sysklogd, and then run:
logger -p local0.crit -t foo "message"
you'll observe in /var/log/daemon.log:
Apr 24 04:14:29 host syslogd 1.5.0#1ubuntu1: restart.
Apr 24 04:15:13 host syslogd: sendto: Permission denied
It appears this is because syslog isn't enabling broadcast on the socket
it is using.
I was hoping rsyslog had fixed this, but the bug is present in version
1.19.12, and worse, it appears not to log any error messages.
It appears the bug is fixed in 3.18.1, but one my machines is running
Ubuntu 8.04 LTS, and will be for a while, where the newer version isn't
available. What might be a good work around for this? Build a local
backport of 3.18.1?
On a side note, I was surprised to see no mention of broadcast in the
rsyslog wiki, forums, or mailing list. I though it was somewhat common
to use broadcast UDP for syslog.
-Tom
More information about the rsyslog
mailing list