When I find something open and check
it again, it is closed. And... cannot
close "syslogd" for report issues.
At least, can not you run syslogd with syslogd_flags="-ss" in /etc/rc.conf ?
It disables listening on 514 at all, but still works locally.
Do not use it, if your machine is used as syslogd "file server" for other
And what about some milter ? It could open some local connections on high
ports. Do not you have some kind of antispam system on your machine ? Or
DansGuardian or something like ?
Have you tried to run "sockstat >> /some/file" every minute from cron and
try to find which process opens the port ?