Send Syslogd To External Host

[plexter]

Hello,

I am having trouble getting my syslogd to forward syslogs to an external host. I'm running OpenBSd 4.8.

I've tried uncommenting the already provided fields and pointing to @ip (where ip is the actual IP address.)

I have also tried *.* @ip

Running 'TCP dump port 514' I see nothing.

In pf I have:

pass out quick on $ext_if inet proto udp from any to any port 514 keep state

running tcp dump -i pflog0; I also see nothing of interest.

I am able to ping the remote host and other devices are able to send to it.

Perhaps I have missed something?


Thanks!

[jggimi]

You won't see anything in pflog(4) for that rule, since you don't log its matches. Only matching rules that have "log" explicitly stated will use the pflog facility. Add "log" to that rule if you want to see if it has any matching packets.

Are you running syslogd with the -u option on the receiving host? This is required.

[plexter]

Thanks for the reply. I was running tcpdump on pflog0 more for anything being denied which does have the log rule set; sorry should have mentioned that. I added log onto the rule posted above but still do not see anything.

The receiving host is a Kiwi Syslog Server (Windows) which does receieve syslogs from other hosts.

Is there anything I can do to verify that syslogs are being sent? Does it matter if I have multiple rules for the same syslog? I'm also logging to file for example.

I should see them being sent regardless if they make it to the log-host or not right?

Any thoughts or troubleshooting steps would be greatly appreciated.

Thanks!