From owner-freebsd-questions@FreeBSD.ORG  Thu Apr 30 14:17:50 2015
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 72EA65EB
 for <freebsd-questions@freebsd.org>; Thu, 30 Apr 2015 14:17:50 +0000 (UTC)
Received: from fly.hiwaay.net (fly.hiwaay.net [216.180.54.1])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 2333C1F2F
 for <freebsd-questions@freebsd.org>; Thu, 30 Apr 2015 14:17:49 +0000 (UTC)
Received: from kabini1.local (rbn1-216-180-76-245.adsl.hiwaay.net
 [216.180.76.245]) (authenticated bits=0)
 by fly.hiwaay.net (8.13.8/8.13.8/fly) with ESMTP id t3UEHlJC030288
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO)
 for <freebsd-questions@freebsd.org>; Thu, 30 Apr 2015 09:17:47 -0500
Message-ID: <5542398B.4000405@hiwaay.net>
Date: Thu, 30 Apr 2015 09:24:02 -0453
From: "William A. Mahaffey III" <wam@hiwaay.net>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: freebsd-questions@freebsd.org
Subject: Re: minor syslog issue
References: <55422366.8060000@hiwaay.net>
 <554229CE.30009@infracaninophile.co.uk> <55422E43.8090206@hiwaay.net>
 <5542348D.8000109@infracaninophile.co.uk>
In-Reply-To: <5542348D.8000109@infracaninophile.co.uk>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Apr 2015 14:17:50 -0000

On 04/30/15 09:02, Matthew Seaman wrote:
> On 04/30/15 14:28, William A. Mahaffey III wrote:
>> 08:23:28.496828 IP RPiB+.59735 > kabini1.local.syslog: SYSLOG
>> syslog.error, length: 59
>> 08:23:28.497229 IP RPiB+.59735 > kabini1.local.syslog: SYSLOG
>> syslog.error, length: 59
> This is the only relevant bit out of your tcpdump output -- it usually
> helps if you filter out as much of the irrelevant stuff that you can[*].
>
> Anyhow, as you can see, your RPiB+ is logging *from* an arbitrary
> high-numbered port.  This time it happens to be using 59735 but that
> would probably change with each restart of syslogd.  Basically use the
> '-a 192.168.0.0/16:*' form in this case.
>
> 	Cheers,
>
> 	Matthew
>
> [*] ie. 'tcpdump port syslog' should work as the packets are being sent
> to the syslog port on your server.
>

I missed that (high port #, thought it might be a process #, *new* to 
tcpdump et al :-/ ) .... Could that be a mal/mis-configuration in the 
(rather beta) NetBSD ARM port ? I will try the updated syslogd flag & 
see how that goes. Thanks :-).

-- 

	William A. Mahaffey III

  ----------------------------------------------------------------------

	"The M1 Garand is without doubt the finest implement of war
	 ever devised by man."
                            -- Gen. George S. Patton Jr.