How to start Syslogd server on Mac to accept remote logging messages?

Question

Anyone knows how to start Syslogd server on Mac to accept remote logging messages?

I started Syslogd, but seems it doesn't accept remote messages.

If I do a netstat -an it looks like udp port 514 is listening. However, if I scan the server from my laptop using nmap then I don't see udp 514. It's likely the port is being blocked somewhere. I have checked ipfw but it does not look like any rules defined.

I've seen lots of articles say that have to specify -r option. Is this the same on Mac? How to do that on Mac?

Answer 1

Syslogd should already be running on your system; what you need to do is enable its UDP listening option. This is controlled by a section near the end of /System/Library/LaunchDaemons/com.apple.syslogd.plist; remove the comment markers so that it looks like this:

<!--         Un-comment the following lines to enable the network syslog protocol listener. -->                 <key>NetworkListener</key>                 <dict>                         <key>SockServiceName</key>                         <string>syslog</string>                         <key>SockType</key>                         <string>dgram</string>                 </dict>         </dict> </dict> </plist> 

And then reload the syslogd daemon either by rebooting, or by running:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist 

UPDATE: Starting in OS X v10.7, Apple switched com.apple.syslogd.plist to a binary plist format, which doesn't include the relevant comment, and isn't editable as plain text. With the new format, PlistBuddy seems to be the easiest way to add the listener:

cd /System/Library/LaunchDaemons sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener dict" com.apple.syslogd.plist sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockServiceName string syslog" com.apple.syslogd.plist sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockType string dgram" com.apple.syslogd.plist sudo launchctl unload com.apple.syslogd.plist sudo launchctl load com.apple.syslogd.plist 

Answer 2

A bit old, but I did have to do this today and whilst searching around for a simple piece of software to do this for me I came across this question.

All I really wanted to do was watch some syslog entries for a short period of time and see what was coming from the server so what I ended up doing was:

sudo tcpdump -lns 0 -w - udp and port 514 | strings 

This will simply print out any message that is sent to your machine on the output so you can display it.

Anyway if you do this and it outputs messages that are being transmitted to your server you can be sure it's not being blocked by your firewall or any other hardware in the middle.