当前位置：文江博客话题详情

如何在Mac上启动Syslogd服务器以接受远程日志记录消息？

发布于 2024-10-30 04:26:25 字数 265 浏览 0 评论 0原文

有人知道如何在 Mac 上启动 Syslogd 服务器来接受远程日志记录消息吗？

我启动了 Syslogd，但似乎它不接受远程消息。

如果我执行 netstat -an ，看起来 udp 端口 514 正在侦听。但是，如果我使用 nmap 从笔记本电脑扫描服务器，则看不到 udp 514。很可能该端口在某处被阻止。我已经检查了 ipfw 但它看起来没有定义任何规则。

我看过很多文章说必须指定 -r 选项。 Mac 上也是这样吗？如何在 Mac 上执行此操作？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

染火枫林 2024-11-06 04:26:25

Syslogd 应该已经在您的系统上运行；你需要做的就是启用它的UDP监听选项。这是由 /System/Library/LaunchDaemons/com.apple.syslogd.plist 末尾附近的部分控制的；删除注释标记，使其看起来像这样：

<!--
        Un-comment the following lines to enable the network syslog protocol listener.
-->
                <key>NetworkListener</key>
                <dict>
                        <key>SockServiceName</key>
                        <string>syslog</string>
                        <key>SockType</key>
                        <string>dgram</string>
                </dict>
        </dict>
</dict>
</plist>

然后通过重新启动或运行来重新加载 syslogd 守护进程：

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

更新：从 OS X v10.7 开始，Apple 将 com.apple.syslogd.plist 切换为二进制 plist 格式，其中不包含相关注释，并且不能以纯文本形式进行编辑。使用新格式，PlistBuddy 似乎是添加监听器的最简单方法：

cd /System/Library/LaunchDaemons
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener dict" com.apple.syslogd.plist
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockServiceName string syslog" com.apple.syslogd.plist
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockType string dgram" com.apple.syslogd.plist
sudo launchctl unload com.apple.syslogd.plist
sudo launchctl load com.apple.syslogd.plist

Syslogd should already be running on your system; what you need to do is enable its UDP listening option. This is controlled by a section near the end of /System/Library/LaunchDaemons/com.apple.syslogd.plist; remove the comment markers so that it looks like this:

<!--
        Un-comment the following lines to enable the network syslog protocol listener.
-->
                <key>NetworkListener</key>
                <dict>
                        <key>SockServiceName</key>
                        <string>syslog</string>
                        <key>SockType</key>
                        <string>dgram</string>
                </dict>
        </dict>
</dict>
</plist>

And then reload the syslogd daemon either by rebooting, or by running:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

UPDATE: Starting in OS X v10.7, Apple switched com.apple.syslogd.plist to a binary plist format, which doesn't include the relevant comment, and isn't editable as plain text. With the new format, PlistBuddy seems to be the easiest way to add the listener:

cd /System/Library/LaunchDaemons
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener dict" com.apple.syslogd.plist
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockServiceName string syslog" com.apple.syslogd.plist
sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockType string dgram" com.apple.syslogd.plist
sudo launchctl unload com.apple.syslogd.plist
sudo launchctl load com.apple.syslogd.plist

回复收藏 0 原文

浪漫之都 2024-11-06 04:26:25

有点老了，但我今天确实必须这样做，在寻找一个简单的软件来为我做这件事时，我遇到了这个问题。

我真正想做的就是在短时间内观察一些系统日志条目，看看来自服务器的内容，所以我最终做的是：

sudo tcpdump -lns 0 -w - udp and port 514 | strings

这将简单地打印出在输出上发送到您的计算机的任何消息，这样你可以显示它。

无论如何，如果您这样做并且它输出正在传输到您的服务器的消息，您可以确定它不会被您的防火墙或中间的任何其他硬件阻止。

A bit old, but I did have to do this today and whilst searching around for a simple piece of software to do this for me I came across this question.

All I really wanted to do was watch some syslog entries for a short period of time and see what was coming from the server so what I ended up doing was:

sudo tcpdump -lns 0 -w - udp and port 514 | strings

This will simply print out any message that is sent to your machine on the output so you can display it.

Anyway if you do this and it outputs messages that are being transmitted to your server you can be sure it's not being blocked by your firewall or any other hardware in the middle.

回复收藏 0 原文

~没有更多了~