User Tools

Site Tools


remote_syslog

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
remote_syslog [2011/12/17 21:51]
ispyisail
remote_syslog [2016/02/09 18:14] (current)
z3braman changed "conloglevel" to "cronloglevel"
Line 1: Line 1:
-====== remote syslog ======+====== Remote Syslog ======
  
-I was able to successfully install syslog-ng3 on Gargoyle TPlink WR1043ND and logging to remote syslog running on my Debian home server.+   
 +===== Introduction ===== 
 +Setting up up syslog remote logging server is good for fault finding.  
 + 
 +When logging connect your gargoyle router to the logging server with an Ethernet cable for more reliable results 
 + 
 +===== Client ===== 
 +Setup your gargoyle router as a syslog client by making a SSH connection to the router and then run the following commands. 
 + 
 +NOTE: Change the IP address to your **syslog server** 
 +==== Set IP server address ====
  
 <shell> <shell>
-opkg update +    uci set system.@system[0].log_ip=192.168.254.1 
-opkg install syslog-ng3+    uci commit 
 +    reboot
 </shell> </shell>
-and missing dependency, syslog-ng won't start without it+ 
 +If the setting are "log_ip" then all syslog messages get sent to that IP address (where a syslog server should be running). 
 + 
 +==== Increase logging Level ==== 
 +Increase the type of message which are sent to the syslog server
  
 <shell> <shell>
-opkg install libdbi+uci set system.@system[0].cronloglevel=7 
 +uci commit 
 +reboot
 </shell> </shell>
  
-Configuration: Edit syslog-ng.conf+This will make it show everything except debugging messages.
  
-<shell> +===== Server =====
-root@Gargoyle:~# cat /etc/syslog-ng.conf +
-@version:3.0+
  
-options { +==== OS X ====
-        chain_hostnames(no); +
-        create_dirs(yes); +
-        flush_lines(0); +
-        keep_hostname(yes); +
-        log_fifo_size(256); +
-        log_msg_size(1024); +
-        stats_freq(0); +
-        flush_lines(0); +
-        use_fqdn(no); +
-};+
  
-source src { +For Mavericks 10.9, and probably earlier:
-        internal(); +
-        unix-stream("/dev/log"); +
-};+
  
-source net { +You need to edit /System/Library/LaunchDaemons/com.apple.syslogd.plist
-        udp(ip(0.0.0.0) port(514)); +
-};+
  
-source kernel { +Look for the Sockets key and add a new section for NetworkListener:
-        file("/proc/kmsg" program_override("kernel")); +
-};+
  
-destination messages { +<code> 
-        file("/var/log/messages"); +  <key>Sockets</key> 
-}; +  <dict> 
-destination d_udp { udp("192.168.0.113" port(514)); }; +    […] 
-log { +    <key>NetworkListener</key> 
-        source(src); +    <dict> 
-        source(net); +      <key>SockServiceName</key> 
-        source(kernel); +      <string>syslog</string> 
-        destination(d_udp); +      <key>SockType</key> 
-#       destination(messages); +      <string>dgram</string> 
-}; +    </dict> 
-</shell>+  </dict> 
 +</code>
  
-I am using my Debian home server and syslog server, here are the relevant lines from syslog server config+The easiest way to do this without running afoul of cached preferences is:
  
-<shell+<code
-destination routermsg { file("/var/log/router.log"); }; +cd /System/Library/LaunchDaemons 
-filter f_router { host(192.168.0.1); }; +sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener dict" com.apple.syslogd.plist 
-log { source(remoteudp); filter(f_router); destination(routermsg); }; +sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockServiceName string syslog" com.apple.syslogd.plist 
-</shell>+sudo /usr/libexec/PlistBuddy -c "add :Sockets:NetworkListener:SockType string dgram" com.apple.syslogd.plist 
 +sudo launchctl unload com.apple.syslogd.plist 
 +sudo launchctl load com.apple.syslogd.plist 
 +</code> 
 + 
 +Thanks http://stackoverflow.com/questions/5510563/how-to-start-syslogd-server-on-mac-to-accept-remote-logging-messages 
 + 
 +==== Windows ==== 
 + 
 +Windows logging server 
 +http://www.kiwisyslog.com/ 
 + 
 +Free Kiwi Syslog Server (download the free version with limited features) 
 + 
 +Download and install  
 + 
 +Under Setting>>Input change to the IP address to your gargoyle router 
 + 
 +{{::2013-09-22_10_17_33-veriton_-_remote_desktop.jpg?500|}} 
  
 +{{:kiwi_syslog_server_version_9.png|}}
remote_syslog.1324158718.txt.gz · Last modified: 2011/12/17 21:51 by ispyisail