Send tcp_input messages to logfile

[izotov]

I have a FreeBSD 7.1-RELEASE with rsyslog central logging. Until the central server is reacheable I get error messages on the console saying something like:

[127.0.0.1]:52045 to [127.0.0.1]:514 tcpflags 0x2<SYN>; tcp_input: Connection attempt to closed port

I would like to send these messages to a logfile but I have not been managed to do so even if I have only

*.*  /var/log/messages

in my /usr/local/etc/rsyslog.conf rsyslog configuration.

What makes these messages keep appearing on the console? Am I missing something in the config?
Thanks for the replies!

 

[SirDice]

What makes these messages keep appearing on the console?

See the file /etc/syslog.conf and it's man page syslog.conf(5).

 

[izotov]

See the file /etc/syslog.conf and it's man page syslog.conf(5).

I saw syslog.conf(5) and found an example

# Log all kernel messages, authentication messages of
# level notice or higher, and anything of level err or
# higher to the console.
# Don't log private authentication messages!
*.err;kern.*;auth.notice;authpriv.none;mail.crit	     /dev/console

I switched to syslog instead of rsyslog and my etc/syslog.conf looks like:

kern.*   /var/log/kern

The messages keep arriving on the console and the logfile is empty.
So this did not help.

 

[SirDice]

The messages keep arriving on the console and the logfile is empty.

Restart or send a HUP to syslogd after you have changed the config.

 

[izotov]

Restart or send a HUP to syslogd after you have changed the config.

Of course I restarted it but did not help. I guess I am missing something trivial... ):

 

[SirDice]

You can test sending different types of syslog messages using the logger(1) command. I usually get the priority wrong and end up tweaking things

 

[jalla]

You can test sending different types of syslog messages using the logger(1) command. I usually get the priority wrong and end up tweaking things

And you could run syslogd with option -d. Very useful for tracing syslog messages.

 

[izotov]

Found finally: an input module definition was missing from the rsyslog.conf:

$ModLoad imklog