MonitorWare Knowledge Base

Hi all, not sure if this is the right subforum, but I figured I'd ask.

I'm getting 1000's of messages on my system console. They consist of:

Code: Select all

Connection attempt to UDP 192.168.2.101:514 from 192.168.2.62:1053

192.168.2.101 is the internal IP of my BSD server, and 192.168.2.62 is the internal IP of my Mail server.

My question is why is this happening, and what can I do to correct it? Thank you.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

This is not rsyslog-specific, but let me give it a try. It looks like a firewall rule logs incoming traffic. Port 514/udp usually is syslog.

HTH
Rainer

Thanks for the reply rgerhards. Is there something I can add in the rsyslog.conf to prevent this?

Well, it depends on what you mean with "prevent". Do you want to stop this message at all? Or do you just want to discard it? The later you can do with a filter and the discard action.

Either or will work for me. I would just like to get these off of my console.

OK, than let's discard them. You need to look up the exact syntax in the doc, but it is along these lines:

Code: Select all

:msg,contains,"Connection attempt to UDP" ~


HTH,
Rainer

Thanks rgerhards. I'm trying to find the exact syntax, I'll let you know what I come up with.

And that goes right in the rsyslog.conf configuration file correct?

gtac wrote:And that goes right in the rsyslog.conf configuration file correct?

Yes, that's right. I'd start with the syntax I suggested, chances are good it is correct.