Scribe Additional logging to external server

[XIII]

If I use Scribe and the firmware built-in logging to an external server, what will be logged on that external server?

• Everything?
• /tmp/syslog.log entries after Scribe filtering?

In case it's the second, how can I log entries filtered by Scribe as well? (Can I use multiple destinations in Scribe? How to configure an external server destination?)

 

[XIII]

RTFM...

Uncomment/correct (hostname "pi") this in /opt/etc/syslog-ng.conf:

destination log_server { udp("pi" port(514)); };

And use this as additional destination in any desired file in /opt/etc/syslog-ng.d:

destination(log_server);

 

[elorimer]

RTFM...

Uncomment/correct (hostname "pi") this in /opt/etc/syslog-ng.conf:

destination log_server { udp("pi" port(514)); };

And use this as additional destination in any desired file in /opt/etc/syslog-ng.d:

destination(log_server);

Nope, obsolete. Use network() instead.

 

[elorimer]

If I use Scribe and the firmware built-in logging to an external server, what will be logged on that external server?

• Everything?
• /tmp/syslog.log entries after Scribe filtering?

In case it's the second, how can I log entries filtered by Scribe as well? (Can I use multiple destinations in Scribe? How to configure an external server destination?)

Nothing. Scribe will terminate the firmware build-in logging, so that doesn't go anywhere.

Scribe does away with /tmp/syslog.log, so not that either.

You need to define the external server destination within syslog-ng, and then use that destination in your logging statements for syslog-ng to send messages to that destination. You could send everything to the remote destination, which would be like the built in logging, but then not much point.

 

[XIII]

Nope, obsolete. Use network() instead.

So that comment in the file is outdated?

EDIT 1: while it does work with "udp", the documentation indeed mentions "network" so I changed it. Thanks!

EDIT 2: and indeed; I don't forward all logs (I keep the Skynet logs on the router only)

 

[elorimer]

So that comment in the file is outdated?

Yes. There is a Scribe thread here about it. I think it is on the SME's todo list to update to network().

Syslog-ng development is very active, and it isn't so much that deprecated modules are removed (although that seems to happen) and stop working, as work on them stops and proceeds with the new modules. The One Identity OSE documentation is now up to 3.30, while the github stuff is at 3.31.2. Entware is keeping pace. While scribe hasn't updated in almost a year, fortunately, since the great time-reap fiasco there hasn't been a critical problem.

 

[scootertramp]

I have a question about what log format is scribe sending when it is configured to forward log data to a central syslog server?
Is it RFC 5424 and if not can it be configured to send log data in RFC 5424 format?

 

[Ripshod]

Scribe uses syslog-ng. Have a read

syslog-ng - Log Management Solutions

syslog-ng is the foundation of log collection and management. Optimize your SIEM, meet compliance requirements, and deliver data from a variety of sources.

www.syslog-ng.com

Apparently, by default RFC5424.

 

[scootertramp]

Scribe uses syslog-ng. Have a read

syslog-ng - Log Management Solutions

syslog-ng is the foundation of log collection and management. Optimize your SIEM, meet compliance requirements, and deliver data from a variety of sources.

www.syslog-ng.com

Thanks, I am searching there now. Just haven't found a straight up solution.
All all my other systems I am using rsyslog and can just add a config to change format. ( module(load="builtinmfile" Template="RSYSLOG_SyslogProtocol23Format")

 

[visortgw]

RTFM...

Uncomment/correct (hostname "pi") this in /opt/etc/syslog-ng.conf:

destination log_server { udp("pi" port(514)); };

And use this as additional destination in any desired file in /opt/etc/syslog-ng.d:

destination(log_server);

Thanks! Appears to work like a champ! I'm actually logging to Synology NAS.

 

[elorimer]

The syslog-ng documentation has moved : https://syslog-ng.github.io/admin-guide/README

 

[scootertramp]

Thanks! Appears to work like a champ! I'm actually logging to Synology NAS.

The syslog-ng documentation has moved : https://syslog-ng.github.io/admin-guide/README

Thank You.

I have been spending quite a bit of time on OSE reading the friendly manual.
As usual I dove in head first and switched an ax92u and 3 xt8 to ASUS Merlin. Syslog-ng is running on all four but
I want to fine tune the format. Currently pushing the router logs to Grafana loki using alloy for the syslog listener
and transport into loki. Loki is a bit picky on how the logs are formatted.