# Send tcp_input messages to logfile



## izotov (Apr 9, 2010)

I have a FreeBSD 7.1-RELEASE with rsyslog central logging. Until the central server is reacheable I get error messages on the console saying something like:

```
[127.0.0.1]:52045 to [127.0.0.1]:514 tcpflags 0x2<SYN>; tcp_input: Connection attempt to closed port
```

I would like to send these messages to a logfile but I have not been managed to do so even if I have only

```
*.*  /var/log/messages
```
 in my /usr/local/etc/rsyslog.conf rsyslog configuration.

What makes these messages keep appearing on the console? Am I missing something in the config?
Thanks for the replies!


----------



## SirDice (Apr 9, 2010)

izotov said:
			
		

> What makes these messages keep appearing on the console?


See the file /etc/syslog.conf and it's man page syslog.conf(5).


----------



## izotov (Apr 9, 2010)

SirDice said:
			
		

> See the file /etc/syslog.conf and it's man page syslog.conf(5).


I saw syslog.conf(5) and found an example

```
# Log all kernel messages, authentication messages of
# level notice or higher, and anything of level err or
# higher to the console.
# Don't log private authentication messages!
*.err;kern.*;auth.notice;authpriv.none;mail.crit	     /dev/console
```
I switched to syslog instead of rsyslog and my etc/syslog.conf looks like:

```
kern.*   /var/log/kern
```
The messages keep arriving on the console and the logfile is empty.
So this did not help.


----------



## SirDice (Apr 9, 2010)

izotov said:
			
		

> The messages keep arriving on the console and the logfile is empty.


Restart or send a HUP to syslogd after you have changed the config.


----------



## izotov (Apr 9, 2010)

SirDice said:
			
		

> Restart or send a HUP to syslogd after you have changed the config.


Of course I restarted it but did not help. I guess I am missing something trivial... ):


----------



## SirDice (Apr 9, 2010)

You can test sending different types of syslog messages using the logger(1) command. I usually get the priority wrong and end up tweaking things


----------



## jalla (Apr 9, 2010)

SirDice said:
			
		

> You can test sending different types of syslog messages using the logger(1) command. I usually get the priority wrong and end up tweaking things



And you could run syslogd with option `-d`. Very useful for tracing syslog messages.


----------



## izotov (Apr 12, 2010)

Found finally: an input module definition was missing from the rsyslog.conf:

```
$ModLoad imklog
```


----------

