Macos – How to enable syslogd to accept incoming connections on Snow Leopard from remote loggers

loggingmacmacososx-serversyslogd

How do I get syslogd to accept incoming connections from remote hosts on Snow Leopard?

I'd like to centralize logging such that various devices and systems send logs to Snow Leopard's syslogd, which normally hangs out on UDP 514. However, I'm unable to get them to successfully be accepted by good ole syslogd. I tcpdumped on the Snow Leopard box to verify that packets are being spouted to port 514 — they are. I checked that syslogd is listening on 514 — it's not.

Googling around told me that, on older versions of OSX (don't you love the way things change so rapidly on OSX), one just had to add a flag to the syslogd daemon to allow remote; one did this in com.apple.syslogd.plist. However the syslogd daemon has no flags (at least in its man page) that suggests any remote anything.

What's the solution to this?

Secondary, less import but relevant question: What's 'newsyslog'? I see a plist file but it's not running (apparently).

Thanks

Best Answer

I haven't tried this, but I looked in the plist for syslogd (/System/Library/LaunchDaemons/com.apple.syslogd.plist) and see this part commented out:

<!--
        Un-comment the following lines to enable the network syslog protocol listener.
-->
<!--
        <key>NetworkListener</key>
        <dict>
                <key>SockServiceName</key>
                <string>syslog</string>
                <key>SockType</key>
                <string>dgram</string>
        </dict>
-->

Remove the comments and then reload the service:

$ sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
$ sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

and you're likely on your way.

Answer to your secondary question -- newsyslog is similar to logrotate often found on linux systems. man newsyslog (or online) will tell you more.

As installed with Snow Leopard, it is run every 30 minutes by launchd per this bit in its plist:

<key>StartCalendarInterval</key>
<dict>
    <key>Minute</key>
    <integer>30</integer>
</dict>
Related Question