syslog module opens a udp port even if syslog backend to lager isn't in use.

[lukebakken]

Find the analysis here: link

It would be nice to not do this unless the syslog backend is in use.

[carlhoerberg]

AFAIK opening and listening to a UDP port is not required to write to another UDP port, and not with syslog either. testing this i can see that writing syslog data to the udp port erlang is opening forwards it to the local syslog server.

Starting eg. cat | logger -d does not open another listening UDP port.

[hairyhum]

According to the API docs gen_udp:open is required to send messages via UDP protocol. Although by default it's configured to be active, which is not so nice if something starts sending messages to the port. That could be something to address in the syslog app.
From the RabbitMQ perspective, the syslog app may be configured to not listen to any ports unless the syslog logger backend is enabled.

[michaelklishin]

In RabbitMQ's case we can also assume that there are very likely no other syslog user on the node, though, and override some of the defaults as we see fit.

[lukebakken]

Erlang/OTP always binds a UDP socket after opening it (source). When only sending UDP datagrams this step isn't necessary and the call to bind/3 is why the socket accepts data (not strictly "listening" since that's a TCP thing).

Options -

• Open a PR in https://github.com/schlagert/syslog to open, send, and close a UDP socket for every log message. This might come at an unacceptable performance cost.
• Open an issue at bugs.erlang.org requesting that client-only UDP be supported.

[lukebakken]

testing this i can see that writing syslog data to the udp port erlang is opening forwards it to the local syslog server

@carlhoerberg - could you show how you are testing? I can't seem to reproduce this. I am using the attached RabbitMQ and syslog-ng configurations (config.zip). As you can see, RMQ has udp port 61712 open:

$ netstat -pan 2>/dev/null | egrep 'udp.*beam.smp'
udp        0      0 0.0.0.0:61712           0.0.0.0:*                           2786/beam.smp

And I send a syslog messages using these commands:

$ echo -n 'test message via RabbitMQ port' | nc -4u -w1 localhost 61712

$ echo -n 'test message via syslog-ng port' | nc -4u -w1 localhost 5140

The second message is echoed by syslog-ng:

[2018-10-02T09:34:27.674754] Incoming log entry; line='test message via syslog-ng port'
[2018-10-02T09:34:27.674795] Initial message parsing follows;
[2018-10-02T09:34:27.674813] Setting value; name='PROGRAM', value='test', msg='0x7f9294003820'
[2018-10-02T09:34:27.674826] Setting value; name='LEGACY_MSGHDR', value='test ', msg='0x7f9294003820'
[2018-10-02T09:34:27.674843] Setting value; name='MESSAGE', value='message via syslog-ng port', msg='0x7f9294003820'
[2018-10-02T09:34:27.674865] >>>>>> Source side message processing begin; instance='0.0.0.0', location='/home/lbakken/issues/rabbitmq/rabbitmq-server/gh-1639/syslog-ng.conf:4:5', msg='0x7f9294003820'
[2018-10-02T09:34:27.674884] Setting value; name='HOST_FROM', value='localhost', msg='0x7f9294003820'
[2018-10-02T09:34:27.674900] Setting value; name='HOST', value='localhost', msg='0x7f9294003820'
[2018-10-02T09:34:27.674917] Setting value; name='SOURCE', value='s_local', msg='0x7f9294003820'
[2018-10-02T09:34:27.675182] <<<<<< Source side message processing finish; instance='0.0.0.0', location='/home/lbakken/issues/rabbitmq/rabbitmq-server/gh-1639/syslog-ng.conf:4:5', msg='0x7f9294003820'
[2018-10-02T09:34:27.675419] Outgoing message; message='Oct  2 09:34:27 localhost test message via syslog-ng port\x0a'
[2018-10-02T09:34:27.675469] Window size adjustment; old_window_size='999', window_size_increment='1', suspended_before_increment='FALSE', last_ack_type_is_suspended='FALSE'
[2018-10-02T09:34:27.675497] LogSource window is empty;
Oct  2 09:34:27 localhost test message via syslog-ng port

So it seems as though data sent to the UDP port that Erlang has open via schlagert/syslog is just dropped.

[lukebakken]

FWIW, the following configuration will set the udp socket to bind to 127.0.0.1:
rabbitmq.config.txt

If a user doesn't set this pretty obscure setting we could default to 127.0.0.1. Ideally the socket would not be bound to a local address but that requires a change in Erlang/OTP.