[rsyslog] directing logs to a broadcast address fails
tmetro+rsyslog at gmail.com
Thu Apr 30 00:45:13 CEST 2009
Rainer Gerhards wrote:
>> I was hoping rsyslog had fixed this, but the bug is present in version
>> 1.19.12, and worse, it appears not to log any error messages.
> That's a *veeeery* old version ;)
Yeah, I figured. I noticed Debian jumped from 1.x to 3.x between Etch
and Lenny, and even the faster paced Ubuntu did likewise between 8.04
>> What might be a good work around for this? Build a local
>> backport of 3.18.1?
> Why not install from source?
Just the usual reasons...more maintenance work down the road. If I
install from source, it'll pretty much stay frozen at that version until
something breaks, I'm motivated by new features to upgrade, or I do an
OS upgrade. Packaging makes installing security updates practical.
I'll try doing the backport. As long as there aren't any
interdependencies that can't be met (like reliance on a newer kernel or
shared library), it should just be a matter of grabbing the newer
package source and rebuilding. Then when the OS eventually gets
upgraded, it'll automatically get updated too.
> ...only very occasionally come across [broadcast being used] (but of
> course it makes sense if you have multiple receivers or want to hide
> where the receiver actually is).
I'm using broadcast as a means of distributing relatively rare critical
notifications to all machines with a desktop I use. Reliability isn't
critical as there will be redundancy in multiple receivers, traditional
local logging, and eventual log analysis and reporting (logwatch).
I considered using an IM protocol for this, but that requires depending
on a server. It's hard to beat the simplicity of a broadcast UDP packet,
and using syslog, which was already involved to some extent, seemed natural.
More information about the rsyslog