Re: [loganalysis] Re: syslog, was Re: greetingz

From: Sweth Chandramouli (svcat_private)
Date: Tue Aug 21 2001 - 08:00:07 PDT

  • Next message: John Fulmer: "Re: [loganalysis] Syslog enabled devices"

    On Tue, Aug 21, 2001 at 12:28:26AM -0400, John Swope wrote:
    > After having read the scale of some of the systems/configurations
    > being discussed on the list, I feel pretty cheesy in even mentioning
    > this,
    	Don't.  Syslog is syslog is syslog, and the issues
    involved are much the same no matter what you're doing.
    
    > but my little Linksys cable/dsl NATing router will send syslog
    > messages to either a unicast address or to the broadcast address of
    > the LAN's ethernet segment.  It works. And if broadcasting works on
    > this $100 toy then I would assume that it will work on bigger/fancier
    > systems.
    	Similarly, UDP is UDP is UDP, so this is a perfectly fine
    example of syslog working over the broadcast address.  To answer the
    other half of the OP's question, it should work fine on multicast, as
    well; I haven't set that up, myself, but I _have_ had to lock down
    some Cisco routers that were listening on multicast after it was
    discovered that IOS didn't deal well with malformed syslog packets
    a few years ago.
    
    	-- Sweth.
    
    -- 
    Sweth Chandramouli ; <svcat_private>
    President, Idiopathic Systems Consulting
    
    
    



    This archive was generated by hypermail 2b30 : Tue Aug 21 2001 - 08:09:37 PDT