Intercepting Syslog log Traffic to a Custom UDP Server

Question

I'm trying to intercept application specific syslog log traffic from a custom UDP server in ubuntu. For testing purposes, I stopped the default syslogd daemon running in port 514 and configured a UDP server to listen to UDP traffic on port 514. I have faced the following questions in doing so:

1. The remote logging feature has to be enabled in /etc/default/syslogd file using SYSLOGD="-r". However, since I stopped the syslogd daemon and am running my own UDP server on port 514, is there any other way to enable remote logging (programmatically, etc.) without using syslog.conf file so that log traffic is sent to the port 514?

2. Is there a way to direct syslog log traffic to another port with the default port 514 (traffic must be sent to both ports)? If this is the case, I can easily run a custom UDP daemon in the second port and intercept log traffic.

Thanks.

Answer 1

You can't have two daemons listening on the same port. Set up your UDP test server (eg netcat) to listen on another port (eg 1514) and configure your ubuntu server to send logs to this port.