[rsyslog] directing logs to a broadcast address fails

[Tom Metro]

Rainer Gerhards wrote:
>> I was hoping rsyslog had fixed this, but the bug is present in version
>> 1.19.12, and worse, it appears not to log any error messages.
> 
> That's a *veeeery* old version ;)

Yeah, I figured. I noticed Debian jumped from 1.x to 3.x between Etch 
and Lenny, and even the faster paced Ubuntu did likewise between 8.04 
and 8.10.


>> What might be a good work around for this? Build a local
>> backport of 3.18.1?
> 
> Why not install from source?

Just the usual reasons...more maintenance work down the road. If I 
install from source, it'll pretty much stay frozen at that version until 
something breaks, I'm motivated by new features to upgrade, or I do an 
OS upgrade. Packaging makes installing security updates practical.

I'll try doing the backport. As long as there aren't any 
interdependencies that can't be met (like reliance on a newer kernel or 
shared library), it should just be a matter of grabbing the newer 
package source and rebuilding. Then when the OS eventually gets 
upgraded, it'll automatically get updated too.


> ...only very occasionally come across [broadcast being used] (but of
> course it makes sense if you have multiple receivers or want to hide
> where the receiver actually is).

I'm using broadcast as a means of distributing relatively rare critical 
notifications to all machines with a desktop I use. Reliability isn't 
critical as there will be redundancy in multiple receivers, traditional 
local logging, and eventual log analysis and reporting (logwatch).

I considered using an IM protocol for this, but that requires depending 
on a server. It's hard to beat the simplicity of a broadcast UDP packet, 
and using syslog, which was already involved to some extent, seemed natural.

  -Tom