2

On my ubuntu 14.04 machine, rsyslog service is running healthily...

service rsyslog status returns,

rsyslog start/running, process 794

cat /proc/794/cmdline shows,

rsyslog  #meaning rsyslog is running with default params.

Now, i am trying to check if rsyslog is having a TCP/UDP listening connection on port 514 using,

netstat -lnup | grep 514   #for udp
netstat -lntp | grep 514   #for tcp

Both of the netstat commands return empty.

Still, how can it run a server without a listening port?

7

rsyslog doesn't listen on INET sockets by default. Instead, it binds to /dev/log, which is a Unix domain socket.

# ls -la /proc/$(pidof rsyslogd)/fd
total 0
dr-x------ 2 root root  0 Jul 20 11:28 .
dr-xr-xr-x 7 root root  0 Jul 20 11:05 ..
lrwx------ 1 root root 64 Jul 20 11:28 0 -> socket:[3559]
l-wx------ 1 root root 64 Jul 20 11:28 1 -> /var/log/syslog
...

# netstat -x | grep 3559
unix  19     [ ]         DGRAM                    3559     /dev/log
2

check the below command too,

# netstat -anp | grep rsyslogd

 unix  9      [ ]         DGRAM                    74832746 5570/rsyslogd       /dev/log

or

 # netstat -anp | grep 514
    tcp        0      0 192.168.122:45405        192.168.0.210:514          ESTABLISHED 5570/rsyslogd       
    tcp        0      0 192.168.122:45459        192.168.0.210:514          ESTABLISHED 5570/rsyslogd       

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.