FreeBSD 13 – syslogd fails to forward logs to remote collector – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Central logging misses host events, reducing observability and incident response quality.

Environment & Reproduction

Appears after network policy changes or malformed syslog.conf entries.

service syslogd status
cat /etc/syslog.conf
logger test-forward

Root Cause Analysis

Remote destination syntax, protocol mismatch, or firewall egress block prevents log forwarding.

Quick Triage

Check syslog daemon options and outbound connectivity to collector.

ps aux | grep syslogd
nc -zv loghost.example 514
pfctl -sr | head -n 40

Step-by-Step Diagnosis

Validate syslog.conf forwarding lines and observe outbound packets.

grep -n '@' /etc/syslog.conf
tcpdump -ni any host loghost.example and port 514 -c 20
service syslogd restart

Solution – Primary Fix

Correct forwarding target entry and restart syslogd.

echo '*.* @loghost.example:514' >> /etc/syslog.conf
service syslogd restart
logger -t forward-test "syslog forwarding check"

Solution – Alternative Approaches

Switch to syslog-ng or relay through local collector for TLS requirements.

pkg install -y syslog-ng

Verification & Acceptance Criteria

Test messages appear in remote SIEM within defined SLA.

logger -t verify "remote log test"
tail -n 50 /var/log/messages

Rollback Plan

Remove new forward rule if collector instability creates message backlog.

cp -a /etc/syslog.conf.bak /etc/syslog.conf
service syslogd restart

Prevention & Hardening

Monitor forwarding health and validate collector certificates/policies periodically.

sockstat -4 -6 | grep syslogd

Related Errors & Cross-Refs

Commonly tied to DNS failures, route loss, or firewall egress denies.

Related tutorial: View the step-by-step tutorial for FreeBSD 13.

View all FreeBSD 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD syslogd configuration and centralized logging recommendations.