2

On my ubuntu 14.04 machine, rsyslog service is running healthily...

service rsyslog status returns,

rsyslog start/running, process 794

cat /proc/794/cmdline shows,

rsyslog  #meaning rsyslog is running with default params.

Now, i am trying to check if rsyslog is having a TCP/UDP listening connection on port 514 using,

netstat -lnup | grep 514   #for udp
netstat -lntp | grep 514   #for tcp

Both of the netstat commands return empty.

Still, how can it run a server without a listening port?

7

rsyslog doesn't listen on INET sockets by default. Instead, it binds to /dev/log, which is a Unix domain socket.

# ls -la /proc/$(pidof rsyslogd)/fd
total 0
dr-x------ 2 root root  0 Jul 20 11:28 .
dr-xr-xr-x 7 root root  0 Jul 20 11:05 ..
lrwx------ 1 root root 64 Jul 20 11:28 0 -> socket:[3559]
l-wx------ 1 root root 64 Jul 20 11:28 1 -> /var/log/syslog
...

# netstat -x | grep 3559
unix  19     [ ]         DGRAM                    3559     /dev/log
1

check the below command too,

# netstat -anp | grep rsyslogd

 unix  9      [ ]         DGRAM                    74832746 5570/rsyslogd       /dev/log

or

 # netstat -anp | grep 514
    tcp        0      0 192.168.122:45405        192.168.0.210:514          ESTABLISHED 5570/rsyslogd       
    tcp        0      0 192.168.122:45459        192.168.0.210:514          ESTABLISHED 5570/rsyslogd       

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy