`syslogd` showing connections to local host and `127.0.0.1`
reddit / BSD

----------------------------------------------------------------------
Incognito2834 · 2022-02-02 16:26

I have a weird process that shows up on random processes, where by I
see \`syslogd\` connecting to \`127.0.0.1\` or \`localhost\`. Very
little data gets sent, but I am concerned that there might be
something else going on, which I can't see.

For example in the following screenshot \`syslogd\` shows a Device
\`0x3732b65bb301fb55\` connecting to a \`UDP\*:57811\`.

Can someone tell me why that is happening? Does anybody else see
something like this on their BSD systems? I am on macos.

https://preview.redd.it/mwxhkn1l4gf81.png?width=1856&format=png&auto=w
ebp&s=5167262e0a2529084ac795a69e27859a576b83cb

----------------------------------------------------------------------
Kernigh · 2022-02-03 05:31

syslogd collects messages from other programs, and stores them in
files (often in /var/log). Some of these messages might go through the
UDP socket. My OpenBSD's
[syslogd(8)](https://man.openbsd.org/syslogd.8) has closed its UDP
socket, because my
[syslog.conf(5)](https://man.openbsd.org/syslog.conf.5) didn't
configure UDP. Other systems might be different.

Your syslogd is on UDP port 57811 (which looks random), so it doesn't
receive messages on UDP port 514 (the well-known syslog port).