We got a server running 10.0-RELEASE-p7 with rsyslogd (installed via pkg) to receive logs via TCP. As rsyslogd failed to log local messages I've disabled local logging by rsyslogd and re-enabled syslogd in rc.conf adding '-s' to the flags b/c the manpages states: -s Operate in secure mode. Do not log messages from remote machines. If specified twice, no network socket will be opened at all, which also disables logging to remote machines. user@sysloghost:~% grep syslog /etc/rc.conf hostname="sysloghost.domain.tld" syslogd_enable="YES" syslogd_flags="-s -v -v" rsyslogd_enable="YES" A few hours ago I checked on rsyslogd b/c of some monitoring glitch, ran `sockstat(1)` and was suprised seeing syslogd listening on 514/udp6: user@sysloghost:~% sockstat | grep syslog root syslogd 68516 4 dgram /var/run/log root syslogd 68516 5 dgram /var/run/logpriv root syslogd 68516 6 udp6 *:514 *:* <========= root rsyslogd 25668 0 udp4 *:514 *:* root rsyslogd 25668 1 tcp4 ${SYSLOG_IP}:514 ${SYSLOG_CL1}:47563 root rsyslogd 25668 3 tcp6 *:514 *:* root rsyslogd 25668 4 tcp4 *:514 *:* root rsyslogd 25668 5 tcp4 ${SYSLOG_IP}:514 ${SYSLOG_CL2}:41922 root rsyslogd 25668 7 tcp4 ${SYSLOG_IP}:514 ${SYSLOG_CL3}:48601 root rsyslogd 25668 9 tcp4 ${SYSLOG_IP}:514 ${SYSLOG_CL4}:60310 Right now that's no problem for us as the setup is currently IPv4 only but clearly isn't what the manpage states and might cause problems in a similar setup with IPv6.
Using -s doesn't disable listening socket. To disable syslogd's network socket you must use "-s -s".
You're right, I just took a quite glance at the part of the manpage I've pasted earlier today and just read "Operate in secure mode. Do not log messages from remote machines. ... no network socket will be opened at all". Maybe the "If specified twice" should be bold or something so it's harder to overlook. Can someone give me a usecase for `syslogd -s` (opening the upd-socket but apparently not logging received log messages)? I can't imagine any common usecase for this behaviour (only, like, "implementing a syslog-blackhole on your network"). And '-s' only circumvents a malicious hosts filling the logservers disks with garbage but seems to still allow trafic to be directed at syslogd.
The use case for -s is to allow sending log messages to a remote server over UDP, but not accept messages from others.
(In reply to Ed Maste from comment #3) > The use case for -s is to allow sending log messages to a remote server over > UDP, but not accept messages from others. So I guess I'm right that `syslogd -s` shouldn't be listening on 514/udp6 because it's only supposed to send data.
(In reply to florian.ermisch from comment #4) There is no such thing as "LISTENING" for UDP protocol.