Originally posted by: jetyvand

Hi.

I want to change the port syslog sends messages from 514/udp to something else. This because I want to make it easier to sort the massages from AIX on Splunk. I tried to find something in the /etc/syslog.conf file, but no luck. 

Anyone? :)

Originally posted by: Wouter Liefting

Haven't checked, but if you modify the entry in the /etc/services file, does that work?

Sometimes the port number to use is not hard-coded in the binary executable, but is taken from the /etc/services file. So if you modify the /etc/services entry

syslogd 514/udp

to

syslogd 1234/udp

your daemon may just start listening on 1234 instead of 514, and the client code (e.g. the logger command) may just use 1234 as well.

But like I said, I have not checked this.

If it doesn't work, it should be possible with some cleverly crafted firewall rules.