0

I am losing syslog packets between two redhat servers. They are both virtual machines and have a couple of virtual firewalls inbetween them. I have no access to the firewalls but am assured that the packets are flowing without issue. If I do a tcpdump on server 1, I see everything leaving as it should, but only SOME of it arrives on server 2, again as seen in tcpdump. My understanding of tcpdump is that it's very low level, so will not be affected by something like iptables. I cannot see any errors on either machine in ifconfig or netstat. I'm almost certain it's the network inbetween, but the only thing putting doubt in my mind is if I manually send a UDP packet by echoing some text to /dev/udp/, they always arrive. I've even sent one packet a second for a few minutes with an iterative loop, but there is no loss - which doesn't really tie in with my network congestion theory.

Any ideas?

  • A little of my above comment got lost. I am sending manual syslog packets by using: echo "a packet" > /dev/udp/1.2.3.4/514 – funkshun Apr 5 at 15:44
  • Any reason to use UDP specifically, and not TCP, which provides reliable transport? Also, if you have rsyslog (going by the RHEL tag), you could configure the daemon itself to send the log messages to a remote server over TCP or UDP. – Haxiel Apr 5 at 16:29
  • We cannot guess why two firewalls lose UDP/syslog packets. – Rui F Ribeiro Apr 5 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.