how to stop syslog to listen on udp port ?

[djoux]

Hi,

i want stop syslogd to listen on udp port. I wonder if it's possible on aix (version 5.1 in my case). I have try -r option but syslogd continue to listen anyway. Someone has a idea ?

Thanks,

Alain

 

[madmurdock]

I wonder what you really want to do? The -r flag suppresses logging from messages of remote hosts, so maybe you took the -r parameter from another UNIX?

It is hard compiled for the syslogd to listen on 514/udp with no chance to change it.

Regards

mad


Advanced Interactive eXecutable

 

[djoux]

I have used "-r" option because i thought if it suppressed messages from remote hosts, it could stop syslogd to listen on port too. I will use ipsec to block this port.

Thanks

 

[madmurdock]

I just guess: Are you in trouble with a portscan from your adminstators who advice you to shutdown all udp ports? Then Ipsec could help yxou to hide this, indeed.

regards

mad

Advanced Interactive eXecutable

 

[bambock]

Another alternative you may want to consider is syslog-ng:

http://www.balabit.com/products/syslog_ng/

Syslog-ng can be configured to listen on TCP/601. Anyone else have any experience with NG and AIX?