Remote logs problems

I have had a look through that chat log. My understanding of that is that TCP would not be able to be used as a protocol for the remote syslog.
IPFire is using sysklogd (note the k in the name) but it could also be that sysklogd also cannot use TCP.

I found a post in IPFire
https://community.ipfire.org/t/shipping-logs-to-logstash/4160/6
That says that sysklogd cannot support TCP or TLS so that would also be in line with what your chat output provided.

In that same IPFire forum thread there are more posts starting with
https://community.ipfire.org/t/shipping-logs-to-logstash/4160/28
that indicate that an alternative, rsyslog, was being looked at back in 2018 and there is the suggestion that the TCP protocol option in the remote logging was something added as a future option. Unfortunately that rsyslog (only TCP and not configured for TLS) work never got completed into a final patch set submission and no other volunteer has stepped forward to pick the work up.

I suspect that if a bug is raised on that protocol then what would happen is that the TCP option would be removed as most of the core developers are focussed on IPFire3.x or fixing security/privacy or basic function issues with IPFire2.x.

EDIT:
@ummeegge replied while I was typing my response out so his reply already covers most of what I have said.

1 Like