Syslog port

[rothchild]

When I look at my syslogs I show the last message received was 5/25/07. I looked at a couple of hosts and they are still sending the syslogs to my cacti but they dont show up. I scanned the cacti server and I dont see port 514 as being open so it seems as if it isnt listening for incoming syslog messages. The dbase for syslog shows the last incoming message was the same date (5/25/07). Any help is appreciated!

Cacti Version - 0.8.6i
Plugin Architecture - 1.0
Poller Type - Cactid v0.8.6i
Server Info - Linux 2.6.9-55.EL
Web Server - Apache/2.0.52 (CentOS)
PHP - 4.3.9
PHP Extensions - yp, xml, wddx, tokenizer, sysvshm, sysvsem, standard, sockets, shmop, session, pspell, posix, pcre, overload, mime_magic, iconv, gmp, gettext, ftp, exif, dio, dbx, dba, curl, ctype, calendar, bz2, bcmath, zlib, openssl, apache2handler, gd, mysql, snmp, eAccelerator
MySQL - 4.1.20
RRDTool - 1.2.15
SNMP - 5.1.2
Plugins

• PHP Network Weathermap (weathermap - v0.91)
  Thresholds (thold - v0.3.0)
  Device Monitoring (monitor - v0.7)
  Network Discovery (discovery - v0.7)
  Network Tools (tools - v0.2)
  Syslog Monitoring (haloe - v0.4)
  mactrack
  RRD Cleaner (rrdclean - v1.1)
  Update Checker (update - v0.3)
  FlowView (flowview - v0.3)
  Host Info (hostinfo - v0.1)
  Error Images (errorimage - v0.1)

[idle]

I dont see port 514 as being open

So start your syslogd and make him open.

[rothchild]

Is not syslogd replaced with syslog-ng? And if so syslog-ng is running and has been restarted.

[idle]

Is not syslogd replaced with syslog-ng?

Yes, I used "syslogd" in common sence.

And if so syslog-ng is running and has been restarted.

If syslog-ng is up and running, there should be open port 514.
If there isn't then syslog-ng is not running.

[rothchild]

syslog-ng shows a pid of 1119 and top shows it running. The firewall rules show port 514 open (the rules havent been changed since the box was built). Netstat -u shows syslog but doesnt show it is listening:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:smux *:* LISTEN
tcp 0 0 *:mysql *:* LISTEN
tcp 0 0 *:10000 *:* LISTEN
tcp 0 0 *:http *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost.localdomain:smtp *:* LISTEN
tcp 0 0 *:https *:* LISTEN
udp 0 0 *:syslog *:*
udp 0 0 *:10000 *:*
udp 0 0 *:snmp *:*
udp 0 0 *:bootpc *:*
udp 0 0 bravoone.stud17.eiu.edu:ntp *:*
udp 0 0 localhost.localdomain:ntp *:*
udp 0 0 *:ntp *:*
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 5764 /tmp/.font-unix/fs7100
unix 2 [ ACC ] STREAM LISTENING 69161 /dev/log
unix 2 [ ACC ] STREAM LISTENING 5812 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 5298 /var/lib/mysql/mysql.sock

netstat -u shows no udp ports.

Thanks for your help.

[rothchild]

more info...
I had added one weathermap on the friday it quit logging. I removed the weathermap waited about an hour and now I have messages..weird .. am going to add the weathermap again to see if I can kill it again. Thanks for your help.

[rothchild]

When I activated a map in weathermap it stopped the syslog messages again. Any ideas?

[rothchild]

I increased the memory in php.ini and that took care of the issue. Thanks for the replies.

[polletj]

plse check the time and date on the originating machine and the Cacti server.
Also timezone...

My 50 Eurocents