Rsyslogd listening on random UDP port ?

[Colonel]

Hi all,

Does anyone know, why Rsyslogd listens on random (!!!) UDP port, while it is not configured to do so, and used only as syslog "client" forwarding messages to centralized server. It seems that any forwarding clause in /etc/rsyslog.conf like

*.* @ip_address:port

(in my case it is: *.* @172.30.5.7)

makes rsyslog to open and listen random UDP port.

[root@server etc]# netstat -tulpn | grep rsyslog

udp 0 0 0.0.0.0:35457 0.0.0.0:* 7911/rsyslogd

Could anyone explain why does this happen ?


rsyslogd 8.24.0, compiled with:
PLATFORM: x86_64-redhat-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64

CentOS Linux release 7.4.1708 (Core)
Linux 3.10.0-693.21.1.el7.x86_64 #1 SMP Wed Mar 7 11:55:49 PST 2018 x86_64 x86_64 x86_64 GNU/Linux