Syslog logging issues

Question

I am having trouble setting up a server for syslogd files on Solaris 10 update 8 (october release, i think). I have this working find on another machine, it has solaris 10 update 7, although I doubt that the difference in Solaris updates is the problem. The working machine is host "Ysera" and the non-working machine is host "malygos".
I have logs coming from a remote host, and I'd like them to be logged to their own log file (travistest). They are coming in through the local4 facility.
Following is the syslog.conf file. This file is identical for both hosts.
### comments ####
local4.debug                     /tmp/travistest
local3.debug                     /tmp/travistest
local1.debug                     /tmp/travistest
*.debug                            /var/adm/messages
*.alert                              root
#  These are tabs and NOT spaces, and no trailing whitespace after the actionThe /etc/services file DOES have the line. This is true for both machines.
syslog      514/udpI can verify that remote logging is activated on both:
root@malygos#svccfg -s system-log listprop | grep remote
config/log_from_remote                     boolean true
root@ysera#svccfg -s system-log listprop | grep remote
config/log_from_remote                     boolean true true trueAny idea why Ysera gives a value of "true true true"?? that is crazy talk to me. Also, strangely, look at the /etc/default/syslogd for Ysera (the working machine)
# all those comments that say that this file is deprecated
# The LOG_FROM_REMOTE setting used to affect the logging of remote messages.
# Its definition here will override the svccfg(1M) settings for log_from_remote
# log_from_remote=yeslog_from remote is still commented out!! so how is it still active?
I have altered the /ect/default/syslogd file in the Malygos (non-working) machine to match this, and also to uncomment it and had no luck. I've attempted to use the setprop command to match the "true true true" property and recieved a syntax error. I tried again trying to put quotes are the "true true true", single quotes, ticks, no marks, and nothing works.
Does anyone have any ideas how I can get the remote log to work?? I know that the port is open...
root@malygos#netstat -an | grep 514
    *.514                         *.*                         0            0      49152           0         LISTENI cannot just make Ysera my log server. Both of these machines are development machines and do not carry the "gold" copy of the system files. In order to send a delivery I need to know why Ysera is working so I can duplicate that code for our final product. Thanks ahead of time for any ideas.

Answer 1

Thanks again for the response!!
root@malygos#svcs -a | grep ipf
disabled 13:59:02 svc:/network/ipfilter:defaultipf.conf
root@malygos#cat /etc/ipf/ipf.conf | grep 514
pass in quick proto tcp from pool/700 to any port = 514 keep state
pass in quick proto udp from pool/800 to any port = 514
root@ysera#more /etc/ipf/ipf.conf
#ipf.conf
# IP Filter rules to be loaded during startup
# See ipf(4) manpage for more information on
#IP Filter rules syntaxDespite the IP filter being disabled, I think that these files being so different is a sign of something. I'll have to check with the team to see why they are different, because I dont' think that they are supposed to be!! (let me know if i'm chasing a ghost again)
The machines are on the same subnet, and I have used Malygos to send message OUT and have other Ysera recieve them...and that works fine. It will not work backwards though, so I agree it's a blocked port or perhaps some of the scripts that start syslogd are not providing the -r option as I expect. A big part of me just wants to jump to Ysera and make that our baseline...but I need to be able to replicate the files. Currently I'm trying to alter /lib/svc/method/system-log to force the -r option. (no worries...I kept the original :-)
I'm also trying to get it to log the parameters that syslogd is started with...so I know exactly what the computer THINKS its doing.
Thanks again dude!!
Edited by: mandarbshadar on Mar 2, 2010 10:34 AM