SYSLOGD Question.... 1

[bran2235]

Hello everyone!

I'm running syslogd on a Linux /Centos box which is capturing Windows Event Logs from remote Windows servers.

The agent on my Windows Servers is called Datagram Syslog Agent, Version 3.4

My Question
If my Linux SyslogD box goes down, I'm curious what will happen to the windows servers (i.e. trying to send log events to the linux server)? I was asked in change control meeting if it might go into an infinite loop or something because it (the windows server) can't talk to the Linux box...

Does anyone have any experience or insight with this?

Many thanks!!
Brandon

 

[Annihilannic]

I don't know, but I can think of one really easy way to find out... ;-)

Annihilannic.

 

[geirendre]

By default syslog-clients use UDP to send messages to syslog-servers.
UDP is connectionless, meening if a packet is lost, then it's well, lost.
Nothing happens, no retransmit or error messages or anything.

Syslog= UDP on port 514 by default.

http://www.syslog.org/forum/

HTH

 

[bran2235]

Ok Annihilannic,
to your point, I've already done it Nothing 'bad' happened

To Geirendre's Point....
I feel totally dumb now. After setting up the agent on the Window's servers, I should have noticed that it's using UDP!!! (THANKS!!) Man, that Cisco training I went to obvioulsy didn't sink in that well


Thanks all-
Brandon