FreeBSD 14 – syslogd does not accept remote logs after network hardening change

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Centralized logs from network devices stop arriving, reducing incident visibility.

Environment & Reproduction

Seen after syslog_flags changes or firewall updates for UDP/TCP 514.

service syslogd status
sysrc syslogd_flags
sockstat -4 -l | grep 514

Root Cause Analysis

syslogd not started with remote listen flags or ingress path is filtered.

Quick Triage

Check listener sockets and packet arrival on target interface.

tcpdump -ni  port 514 -c 40
service pf status || service ipfw status || true

Step-by-Step Diagnosis

Correlate daemon flags, firewall policy, and rotation permissions.

grep -E 'syslogd|newsyslog' /etc/rc.conf /etc/newsyslog.conf
clog /var/log/messages | tail -n 80

Solution – Primary Fix

Enable remote logging flags and open required firewall paths.

sysrc syslogd_flags='-s -a :*'
service syslogd restart
# allow udp/514 in firewall

Solution – Alternative Approaches

Migrate remote ingest to syslog-ng for structured parsing and TLS transport.

pkg install -y syslog-ng
service syslog-ng enable
service syslog-ng start

Verification & Acceptance Criteria

Remote test messages arrive and are retained with expected source metadata.

logger -n  -P 514 -d 'test remote syslog'
tail -n 20 /var/log/messages

Rollback Plan

Restore previous syslog flags and restart service if parsing pipeline fails.

sysrc -x syslogd_flags
service syslogd restart

Prevention & Hardening

Automate a synthetic remote log probe and alert on ingestion failure.

Related Errors & Cross-Refs

Can be confused with log rotation truncation or clock skew in sender devices.

Related tutorial: View the step-by-step tutorial for FreeBSD 14.

View all FreeBSD 14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

syslogd flags manual, RFC 5424 basics, and FreeBSD logging guidance.