1

Currently rsyslog is listening on both UDP socket and UNIX socket, as shown below:

[root@machine ~]# netstat -ap | grep rsyslog
udp        0      0 0.0.0.0:59018           0.0.0.0:*                           268440/rsyslogd     
unix  2      [ ]         DGRAM                    74163705 268440/rsyslogd      
[root@machine ~]# 
[root@machine ~]#
[root@machine ~]# 
[root@machine ~]# 
[root@machine ~]# uname -a
Linux machine.abc.com 3.10.0-693.17.1.el7.x86_64 #1 SMP Sun Jan 14 10:36:03 EST 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@machine ~]# 

Configuration changes required for rsyslogd's UDP syslog reception is unclear. /etc/rsyslog.conf has no such changes, as shown below:

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf 

$OmitLocalLogging on

$IMJournalStateFile imjournal.state

authpriv.*                      @some_remote_machine.abc.com

where /etc/rsyslog.d/*.conf has following entry:

$SystemLogSocketName /run/systemd/journal/syslog

For security reasons, goal is to disable rsyslogd's UDP syslog reception

strace shows socket() invoked only once on starting rsyslogd

socket(AF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3

Below are the details related to udp:

[root@machine ~]#  rsyslogd -d 2>&1|grep -i udp
4078.341962469:main thread    : tplAddLine processing template 'RSYSLOG_omudpspoofDfltSourceTpl'
4078.350580740:main thread    : Template: Name='RSYSLOG_omudpspoofDfltSourceTpl' 
[root@machine ~]# rsyslogd -v
rsyslogd 8.24.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.
[root@machine ~]# 

How to configure rsyslog to disable UDP syslog reception? Because we have syslog-ng installed...

1

Disable the loading of imudp module. Example below.

Confirm is currently using UDP

# netstat -ap|grep rsyslog
udp        0      0 0.0.0.0:syslog          0.0.0.0:*                           17076/rsyslogd
udp6       0      0 [::]:syslog             [::]:*                              17076/rsyslogd
unix  2      [ ]         DGRAM                    1074728  17076/rsyslogd
#

Check config file

# grep -i udp /etc/rsyslog.conf
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
#

Disable UDP and restart rsyslog

# sed -i 's/\$ModLoad imudp/#\$ModLoad imudp/' /etc/rsyslog.conf
# systemctl restart rsyslog
#

Confirm now only using TCP

# netstat -ap|grep rsyslog
unix  2      [ ]         DGRAM                    1073845  16982/rsyslogd
#
  • It is already disabled – overexchange Oct 27 '18 at 9:42
  • Perhaps enabled in /etc/rsyslog.d/*.conf ? If still no luck try updating question with output of rsyslogd -d 2>&1|grep -i udp ? Also add which version of rsyslogd in play, via rsyslogd -v ? – steve Oct 27 '18 at 9:50
  • 1
    Query updated with requried details – overexchange Oct 27 '18 at 9:55
  • 1
    Got the hint. Disabling $ModLoad imjournal disabled UDP port. But, what are the side affects? Config file is in the query – overexchange Oct 27 '18 at 10:09
0

I've had some issues running both rsyslog and syslog-ng on RHEL 7.5, and even trying to stop or kill process did not help. So I decided to delete rsyslog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.