Tunneling syslog udp setup question

Markus Moeller <[email protected]> Mon, 24 Jan 2005 19:23:06 +0000
Newsgroups gmane.comp.security.zebedee.general
Message-ID <[email protected]>
I'd like to tunnel syslog from oner server to another securely and reliable via
tcp without replacing the Solaris syslog daemon. 


The linux server is configure to listen on remote and local syslog messages on
port 514

Server(Linux ip:10.10.2.1):

./zebedee -v 9 -d -D -b 10.10.2.1 -s 127.0.0.1:514 -u  -T 10000


I added the following line to syslog.conf on my Solaris machine to forward any
syslog message to its ip-address on port 514 where zebedee is listening on(The
syslogd is configured not to listen on remote syslog messages on port 514):
*.debug      @10.10.1.1

Client(Solaris ip:10.10.1.1):

./zebedee -v9 -d -D -u -T 10000 -b 10.10.1.1  514:10.10.2.1:514
zebedee(28690/1):    client listener routine entered
zebedee(28690/1):    creating UDP-mode local listener socket for port 514
zebedee(28690/1):      listening on 10.10.1.1
zebedee(28690/1):      local port 514 has socket 3
zebedee(28690/1):  Listening on local port 514
zebedee(28690/1):  listening for client UDP data
zebedee(28690/1):      waiting for client data
zebedee(28690/1):      select returned 1
zebedee(28690/1):      searching for handler for address 10.10.1.1:38266
zebedee(28690/1):      listening on 127.0.0.1
zebedee(28690/1): ERROR: listener bind failed: (Cannot assign requested address)
zebedee(28690/1):      waiting for client data



But the setup doesn't work. It seems the error "listener bind failed: (Cannot
assign requested address)" 
means zebedee can't bind on localhost which I didn't tell it to do.

Has anybody a hint what is the correct configuration ?


Thanks
Markus




-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl