Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Syslog-ng

|

427

logger. (For instructions on using logger, see the section “Testing System Logging

with logger” later in this chapter.)

unix_stream( ) and unix_dgram( ) are important drivers: these read messages from

connection-oriented and connectionless Unix sockets, respectively. Linux kernels

Versions 2.4.1 and higher use Unix datagram sockets: if you specify /dev/log as a

unix_stream( ) source, kernel messages won’t be captured. Therefore, use unix_

dgram( )

when defining your local-system log source, e.g.:

source s_loc { unix-dgram("/dev/log"); internal( ); };

If your kernel is pre-2.4.0, you should instead use unix_stream( ) for /dev/log.

tcp( ) and udp( ) read messages from remote hosts via the connection-oriented TCP

protocol and the connectionless UDP protocol, respectively. In both

tcp( ) and udp( ),

a listening address and a port number may be specified. By default, syslog-ng listens

on 0.0.0.0:514—that is, “all interfaces, port 514.” (Specifically, the default for

tcp( )

is 0.0.0.0:TCP514, and for udp( ) is 0.0.0.0:UDP514.)

Example 12-15 shows source statements for

tcp( ) and udp( ), with IP and port

options defined.

In Example 12-15, we’re defining the source s_tcpmessages as all messages received

on TCP port 10514, but only on the local network interface whose IP address is 192. ...