Syslog daemon

[Brouno]

Hi,

I would like to customize the syslogd daemon to log to an external syslog server.

Where can I do that ?

My first idea is to use init-start script to kill syslogd and start it again with the -R option.

It's working but I would like to know if there is a less dirty option ;-)
I was not able to found where syslogd is initially launched (by busybox ?)

THx.
Bruno

 

[joegreat]

I would like to customize the syslogd daemon to log to an external syslog server.

It's working but I would like to know if there is a less dirty option ;-)
I was not able to found where syslogd is initially launched (by busybox ?)

Hi Bruno,

It looks like there is not other option then to kill syslogd and restart it with the options you need.

This was discussed already serveral times in the past - like here - and I to not recall a different approach.

With kind regards
Joe

 

[Brouno]

OK , thx, my search in the forum was not enough smart to point me this thread

 

[RMerlin]

Hi,

I would like to customize the syslogd daemon to log to an external syslog server.

Where can I do that ?

My first idea is to use init-start script to kill syslogd and start it again with the -R option.

It's working but I would like to know if there is a less dirty option ;-)
I was not able to found where syslogd is initially launched (by busybox ?)

There is an option on the webui for this, under Administration -> System. Just enter the IP of the remote syslog server on that page.

 

[Martineau]

Hi Bruno,

It looks like there is not other option then to kill syslogd and restart it with the options you need.

This was discussed already serveral times in the past - like here - and I to not recall a different approach.

With kind regards
Joe

The script below appears to allow logging to the USB disk, but is there a command missing?

#!/bin/sh


logger -t "($(basename $0))" SYSLOG Housekeeping Running.....
# Called from post-mount to ensure SDCARD/USB device is available

SOURCE=/tmp/syslog.log    # original source of the syslog
SYSLOG=/tmp/mnt/RT-N66U/Syslog/syslog.log    # destination of the syslog

NOW=$(date +"%Y%m%d-%H%M%S")    # current date and time

mv $SYSLOG $SYSLOG-$NOW    # rename the previous log with timestamp
cp $SOURCE $SYSLOG    # copy current syslog to the new location
rm $SOURCE    # delete the syslog

ln -s $SYSLOG $SOURCE   # create a symbolic link from the orginal syslog to the copied one


if [ "$?" -ne 0 ]    # check for error
then
echo "Error in Syslog move! Script: $0"    # display the error message
exit $?
else
echo "Syslog move OK. Script: $0"    # display OK message
exit 0
fi

i.e after a few hours writing the SYSLOG to the USB drive, it reverts back to /tmp..

Manually move the SYSLOG using the script....

admin@RT-N66U:/tmp# ls sysl* -l
-rw-rw-rw-    1 admin    root        105382 Aug  7 16:31 syslog.log
-rw-rw-rw-    1 admin    root        262248 Aug  7 14:29 syslog.log-1


admin@RT-N66U:/tmp# /jffs/scripts/syslog-move.sh
Syslog move OK. Script: /jffs/scripts/syslog-move.sh


admin@RT-N66U:/tmp# ls sysl* -l
lrwxrwxrwx    1 admin    root            34 Aug  7 16:32 syslog.log -> /tmp/mnt/RT-N66U/Syslog/syslog.log
-rw-rw-rw-    1 admin    root        262248 Aug  7 14:29 syslog.log-1


admin@RT-N66U:/tmp/mnt/RT-N66U/Syslog# ls -l
-rw-rw-rw-    1 admin    root        108423 Aug  7 16:34 syslog.log

Several hours later, it is no longer using the USB drive....

admin@RT-N66U:/tmp# ls sysl* -l
-rw-rw-rw-    1 admin    root        149675 Aug  7 21:24 syslog.log
lrwxrwxrwx    1 admin    root            34 Aug  7 16:32 syslog.log-1 -> /tmp/mnt/RT-N66U/Syslog/syslog.log

admin@RT-N66U:/tmp/mnt/RT-N66U/Syslog# ls -l
-rw-rw-rw-    1 admin    root        262161 Aug  7 19:00 syslog.log

RT-N66U using 372_31_0.dwrpyd
Regards

 

[Brouno]

There is an option on the webui for this, under Administration -> System. Just enter the IP of the remote syslog server on that page.

Thx Eric for that,

Sorry I forgot to say that I was aware about this field.
My "problem" is that this field only accept IP adresses, not FQDNORT notation.

Perhaps it worth an evolution ;-)
Bruno

Update: it's give me the idea to track the edit of the field in webui and the settings in nvram

This field update the log_ipaddr value in nvram

a manual edit of the setting via :

nvram set log_ipaddr=FQDN:PORT
nvram commit

and a reboot do the job.

The only drawback is that you can't validate again the webui page Administration > System (for others settings), even if the remote log server value is displayed, you get an error while applying : " FQDNORT is not a valid IP Address!"

Thanks again Eric for giving me the good wire to pull ;-)

 

[Brouno]

Arrrrgh noooo,

It's not working !

My init-start script was in place also overridding the log_ipaddr setting after reboot

Removing my syslogd restart in init-script, the syslogd process show :

syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 7 -R FQDN:PORT:514 -L

hard coded syslog UDP port ":514" is added :-(

 

[RMerlin]

Arrrrgh noooo,

It's not working !

My init-start script was in place also overridding the log_ipaddr setting after reboot

Removing my syslogd restart in init-script, the syslogd process show :

syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 7 -R FQDN:PORT:514 -L

hard coded syslog UDP port ":514" is added :-(

The reason why you need to use an IP is because it needs to be available fairly early in the boot process. You need a static IP for this to work, you can't use a hostname.

Port 514 is the default, no need to specify it.

 

[Brouno]

OK for the IP address.

I know that udp/514 is standard proto/port for syslog, but my syslog facilities doesn't use this standard one, but a specific one

 

[Brouno]

Again !

Finally found :

nvram set log_ipaddr=FQDN |IP
nvram set log_port=PORT
nvram commit

It's working with FQDN too, loosing the start of syslog, but anyway the WAN is not started at early stage of booting, so ... it's the same (in case of logging on WAN obviously)

 

[Quint]

So does all this change after Asus WRT Firmware:378.51?
I am running AC68 with Asus WRT 378.51, and nothing seems to stop the logging madness of my cron jobs.
I run a cron job every minute, and it makes the logs files pretty much not human readable.
Doesn't seem to be changeable on loglevel as this link suggests: http://fatmin.com/2015/01/04/configure-syslog-logging-levels-on-the-asus-rt-ac66u-router/
If i kill syslogd, it immediately restarts.

 

[ColinTaylor]

http://www.snbforums.com/threads/supress-log-output.21733/#post-157390