cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
723
Views
9
Helpful
6
Replies

Syslog server?

John Blakley
VIP Alumni
VIP Alumni

What syslog server do you use? I've tried Kiwi and Solarwinds. I'm not crazy about Kiwi because of it logging to text files, and the Solarwinds version that we have is from the Engineer's toolset which doesn't allow you to select SQL databases. (It uses its own access database.)

I'm looking for something that could possibly be managed via web interface, open-source (but would settle for commercial if good enough).

Thanks!

John

HTH, John *** Please rate all useful posts ***
6 Replies 6

Collin Clark
VIP Alumni
VIP Alumni

*nix based syslog-ng, comes standard w/most distros.

As far as the webUI, I prefer php-syslog-ng, but there may be others.

*Here is another http://www.phplogcon.org/

zhenningx
Level 4
Level 4

We use msyslog on Linux. Works good!

scottmac
Level 10
Level 10

The "Pro" versions for Kiwi will log to a number of supported SQL servers (they even give the field templates).

They are also capable of handling higher inbound traffic levels.

On the *nix side, Rsyslogd has been working well for me, it'll do UDP, TCP and log to some SQL databases (like mySQL). It's also multi-threaded and can handle substantial inbound traffic rates (which is why we went to it, standard *nix syslogd was swamped).

syslog-ng has a free version, I think, but it's crippled compared to the purchased version (I'm not sure about it, that's what I was told).

Rsyslogd is free and not crippled. It is now included with RedHat Enterprise 5.1 and Suse (10.x, 11?)

The other choke point for really heavy inbound loads is the NIC buffers, and the UDP buffer, both of which you may want to adjust ...

Good Luck

Scott

Thanks Scott.

I've decided to try rsyslog, but I'm not getting anything to it.

I have the following:

local7.warn -/var/log/cisco.log

local7.debug -/var/log/cisco.log

In the router I have:

logging

logging trap 6

logging source-interface BVI1

I've tried the facilities as:

logging facility local7

logging facility syslog

and no logging facility specified.

I tried a rsyslogd -d to bring the syslog up on the screen and watch it, and it's not getting anything at all. I can ping the linux box from the router.

My main question is:

What should the facility be set to? Local7 or syslog?

Thanks!

John

HTH, John *** Please rate all useful posts ***

Your configurations seems ok. You do not need to specify logging facility at the router side as I believe Cisco routers use local7 by default.

Is it possible caused by Linux firewall? Can you try to shutdown IPtables?

Zhenning

Can you post up your /etc/rsyslog.conf file?

The default "might not" work from the default installation. Rsyslog docs say it will also read the /etc/syslog.conf file ... but if that wasn't really configured beyond teh defaults, it might not have translated well.

A good way to test it is a utility from (who else?) Kiwi called (I think) sysloggen ... something like that ... it lets you craft test syslog messages (TCP, UDP, any facility, etc) and direct it towards a specific server.

I'll try to pull and sanitize one of my rsyslog.conf files to give you an example. The config file provides with the package is also pretty well documented ...

Good Luck

Scott

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco