Diagnose LAN syslog receiving

Are you asking how to configure syslog.conf to capture the messages? It sounds like you've tried that but it hasn't worked for some reason...?

Showing your syslog.conf changes would be useful.

You have also restarted syslogd, right? (configuration changes are only reflected after syslogd restarts). If not:

<pre class=command>sudo killall -HUP syslogd</pre>

If you're just looking to see what's in the messages without actualy logging them, tcpdump would help there:

<pre class=command>sudo tcpdump -A -i <interface> host 192.168.1.3 and port syslog</pre>

(where <interface> is the interface you want to listen on - typically en0 or en1)

oops, for the tcpdump you may need to add '-s 0' to capture the entire packet, otherwise tcpdump only captures the header and may not show you the actual payload.

For OSX to be a loghost, you need to start syslogd with the -u switch. In Tiger, you can edit /System/Library/LaunchDaemons/com.apple.syslogd.plist and change the second string of ProgramArguments to the -u. Here's mine:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.syslogd</string>
<key>ServiceDescription</key>
<string>Apple System Log Daemon</string>
<key>OnDemand</key>
<false/>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/syslogd</string>
<string>-u</string>
</array>
<key>ServiceIPC</key>
<false/>
</dict>
</plist>

Just make sure that the firewall is allowing 514/UDP to pass and you should be good after restarting syslogd.


Separating the Linux boxes messages to another file is something that I don't know how to do/don't think it can be done. AFAIK, syslogd doesn't distinguish between local and remote messages. So if you target one facility, it's going to go to whatever file whether the Linux box sent the message or whether the OSX box sent the message.

U have ~50 machines logging to my server. When I read the file raw, it is a mess. If I want to pick out a machine, I grep the log for the machine's name or address (or both) and I can isolate the machine easily and quickly.

Perhaps the syslogd and syslog.conf man pages have something to customize it more for you.

Roger