HOWTO make sysklogd (syslogd) listen on multiple ports written by John Newbigin jn@it.swin.edu.au

What is this page about

At out site, all the linux boxes use remote logging so we can collate the logs on a central server.  This works well for a small number of machines but now we want to separate into groups of machines (servers, staff & students).  Unfortunately the syslogd from sysklogd reads a port number only from /etc/services and we can't control the interface which it binds to.

One solution would be to modify the code to solve one or both of these issues but I was looking for a way which did not require source modification.  The solution was to use a chroot environment.

Setting up the chroot

First I will present the commands required for setting this up on Red Hat Enterprise Linux 2.1, then I will list some techniques for working out any steps for yourself.  In the statement below, the # indicates a root shell prompt which you should not type in.

# mkdir -p /var/log/virtual/student
# cd /var/log/virtual/student
# mkdir -p dev etc lib sbin var/log var/run
# cp /sbin/syslogd sbin
# cp /lib/ld-linux.so.2 lib
# cp /lib/libc.so.6 lib
# cp /lib/libnss_dns.so.2 /lib/libnss_files.so.2 /lib/libresolv.so.2 lib
# cp /etc/syslog.conf etc
# cp /etc/host.conf /etc/nsswitch.conf /etc/resolv.conf etc
# cp /etc/localtime etc
# grep syslog /etc/services > etc/services

The daemon can then be started with this command
# chroot /var/log/virtual/student /sbin/syslogd -r

You can control the port that syslogd will use by editing etc/services and modifying the syslog port number.  You should probably use debug mode to make sure that things are working.  To do that, start stunnel with the -d parameter
# chroot /var/log/virtual/student /sbin/syslogd -d -r

If you get errors about missing libraries or file not found errors, your syslogd binary might be linked against different libraries than mine (this is quite possible if you are not running RHEL21).  If so you can get a list of libraries by using the ldd command
# ldd /sbin/syslogd
    libc.so.6 => /lib/i686/libc.so.6 (0x40029000)
    /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

For each library listed, copy it into the lib directory.  Don't worry about using subdirectories like i686 unless you are really anal and want to set up the symlinks.

Because parts of libc are dynamically loaded at run time, you may require libraries which are not listed by ldd.  The easy way to find out what you need it to use strace.  Install strace in your chroot and then run syslogd

# mkdir -p usr/bin
# cp /usr/bin/strace usr/bin
# chroot /var/log/virtual/student /usr/sbin/strace /sbin/syslogd -d -r

Library loads will be shown like this
open("/lib/libnss_files.so.2", O_RDONLY) = 3
If the file can't be found then you will get errors like this
open("/lib/mmx/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
Some errors are OK, others indicate problems.  You will also see requests to open config files like /etc/hosts etc.  Again, some are required and others are not necessary.  You just have to play around till you get the right ones (or RTFM/use the source/ask your local Guru etc.).

Once you have everything set up, write an init script to start everything up the way you want it and your server side is done.

The client side is quite simple, just edit the syslog port number in /etc/services.  You can do this with a simple (?) perl command.  This command will change the port number to 1234.

# /usr/bin/perl -pi -e "s|^syslog[[:space:]].*/udp$|syslog 1234/udp|" /etc/services

For the truly lazy (download)

This is the make script and init script that I use for my machines.  Feel free to customise as necessary. 

Other things to do

logrotate

You probably want to rotate the virtual logs too.  In /etc/logrotate.d make a copy of syslog called syslog_<virtual name> for each of your virtual hosts.  Edit the file and prepend the /var/log/<virtual name> to each of the log file names and the .pid file name

logcheck

If you run psionic logcheck then you can easily edit logcheck.sh to use a virtual directory.  Again if you are lazy you can download my custom version

Last modified 20040709.
Maintained by John Newbigin http://uranus.it.swin.edu.au/~jn