UNIX for Advanced & Expert Users

Mine is solaris 10. (5.10)

I want to stop syslog daemon listening on port 514, so that my application can do the same to modify the incoming events.

I did the following -

# svccfg -s svc:/system/system-log setprop config/log_from_remote = false
# svcadm refresh svc:/system/system-log

Now I tried the following -

# ps -ef | grep -i syslog
root 21892 247 0 15:05:38 pts/6 0:00 grep syslog
root 8416 1 0 May 22 ? 0:01 /usr/sbin/syslogd
#
#
#
# pfiles 8416 | grep 514
#
#
# netstat -aP udp | grep syslog
*.syslog Idle
#

Which shows syslog is active listeneing for remote events. But why did pfiles failed to show 514.. also "pfiles 8416" didn't have any SOCK fd's..
So application still fails to bind it. I've waited for 30 min, 2 hours and entire day, my application was still unable to bind to this post. It cannot be hanging for so long, if at all it was used by some application earlier.
I used sockopt() REUSEADDR also. This makes bind successful, but the application doesn't receive any data..

Questions -
1. Know the process which is using port 514.. i tried - pfiles and lsof
2. Are these 2 config lines -
# svccfg -s svc:/system/system-log setprop config/log_from_remote = false
# svcadm refresh svc:/system/system-log
enough to make syslog stop reading remote events, in-turn not binding to port 514. as "-t" option also doesn't work with Solaris 10.

If i try the following -

1. #svccfg
svc> select system/system-log
svc:/system/system-log> setprop config/log_from_remote = false

Here there's no "config" file/folder already present which would save the option - "log_from_remote "

2. When I tried typing the command ( no pasting as i did earlier), again folder
"system-log" was missing, in the very first command.


# svccfg -s svc:/system/system-log setprop config/log_from_remote = true
# svcadm refresh svc:/system/system-log