No remote logging

Alexandre Santos <[email protected]> Wed, 1 Sep 2021 19:50:09 +0100

Newsgroups	gmane.comp.syslog-ng
Message-ID	<CAHxG_71YWKRKjN4pRAQNMOMWrZRyiwkrSGDyRg6K3FUU2mxwXA@mail.gmail.com>

Hi,

I tying to do some remote logging from a Debian10 with syslog-ng 3.19.

I have 2 syslog-ng's running, one in the default VRF which receives the
logs from the applications, and another syslog-ng in an EXTERNAL VRF which
send the logs to log-servers.

The default VRF sends the logs to the EXTERNAL VRF via a unix domain.

The problem is that sometimes is not streaming anything to remote log
servers after configuring it.
I have to restart the syslog-ng processes to start the remote logging.
Local logging is working fine.

Have you come across this issue before?

Thanks and Regards,
Alex

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

defaultvrf-syslog-ng.conf (application/octet-stream, 1011 B)

@version: 3.19
# First, set some global options.
options {
    chain_hostnames(off);
    flush_lines(0);
    use_dns(no);
    use_fqdn(no);
    owner("root");
    group("root");
    perm(0644);
    stats_freq(0);
    bad_hostname("^gconfd$");
    ts-format("iso");
    time_zone("UTC");
    mark-freq(0);
    frac-digits(3);
};

# common block end


# source default VRF
source s_src {
    unix-stream("/dev/uds_log"
        flags(syslog-protocol)
        keep-hostname(yes)
    );
};
# end source default VRF
# remote: anjr-nm2
destination d_anjr-nm2_udp { 
    syslog("10.124.131.10" transport("udp") ip-protocol(4) port(514) keep-alive(no)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_remote_anjr-nm2_udp {
    level(info .. emerg);
};
log {
    source(s_src);
    filter(f_remote_anjr-nm2_udp);
    destination(d_anjr-nm2_udp);
};
# end of remote server: anjr-nm2

extvrf-syslog-ng.conf (application/octet-stream, 11.7 KB)

@version: 3.19
options {
    chain_hostnames(off);
    flush_lines(0);
    use_dns(no);
    use_fqdn(no);
    owner("root");
    group("root");
    perm(0644);
    stats_freq(0);
    bad_hostname("^gconfd$");
    ts-format("iso");
    time_zone("UTC");
    mark-freq(0);
    frac-digits(3);
};

# common block end


source s_src {
    system();
    internal();
    syslog(ip(19.88.4.17) transport("udp") port(514) keep-alive(no));
};

rewrite r_host { set("10.90.153.144", value("HOST")); };

# localFile: apps
destination d_localfile_apps {
    program("/opt/local/bin/write_with_rotation.sh /var/log/apps.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_apps_local7 {
    facility(local7) and level(info .. emerg);
};
filter f_localfile_apps {
    filter(f_localfile_apps_local7); };
log {
    source(s_src);
    filter(f_localfile_apps);
    destination(d_localfile_apps);
    flags(flow-control);
};
# end of localFile: apps

# localFile: kernel
destination d_localfile_kernel {
    program("/opt/local/bin/write_with_rotation.sh /var/log/kernel.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_kernel_kern {
    facility(kern) and level(info .. emerg);
};
filter f_localfile_kernel {
    filter(f_localfile_kernel_kern); };
log {
    source(s_src);
    filter(f_localfile_kernel);
    destination(d_localfile_kernel);
    flags(flow-control);
};
# end of localFile: kernel

# localFile: messages
destination d_localfile_messages {
    program("/opt/local/bin/write_with_rotation.sh /var/log/messages.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_messages_mail {
    facility(mail) and level(info .. emerg);
};
filter f_localfile_messages_daemon {
    facility(daemon) and level(info .. emerg);
};
filter f_localfile_messages_syslog {
    facility(syslog) and level(info .. emerg);
};
filter f_localfile_messages_lpr {
    facility(lpr) and level(info .. emerg);
};
filter f_localfile_messages_uucp {
    facility(uucp) and level(info .. emerg);
};
filter f_localfile_messages_cron {
    facility(cron) and level(info .. emerg);
};
filter f_localfile_messages_ftp {
    facility(ftp) and level(info .. emerg);
};
filter f_localfile_messages_ntp {
    facility(ntp) and level(info .. emerg);
};
filter f_localfile_messages_security {
    facility(security) and level(info .. emerg);
};
filter f_localfile_messages_console {
    facility(console) and level(info .. emerg);
};
filter f_localfile_messages_solaris-cron {
    facility(solaris-cron) and level(info .. emerg);
};
filter f_localfile_messages {
    filter(f_localfile_messages_mail) or filter(f_localfile_messages_daemon) or filter(f_localfile_messages_syslog) or filter(f_localfile_messages_lpr) or filter(f_localfile_messages_uucp) or filter(f_localfile_messages_cron) or filter(f_localfile_messages_ftp) or filter(f_localfile_messages_ntp) or filter(f_localfile_messages_security) or filter(f_localfile_messages_console) or filter(f_localfile_messages_solaris-cron); };
log {
    source(s_src);
    filter(f_localfile_messages);
    destination(d_localfile_messages);
    flags(flow-control);
};
# end of localFile: messages

# localFile: security
destination d_localfile_security {
    program("/opt/local/bin/write_with_rotation.sh /var/log/security.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_security_auth {
    facility(auth) and level(info .. emerg);
};
filter f_localfile_security_authpriv {
    facility(authpriv) and level(info .. emerg);
};
filter f_localfile_security {
    filter(f_localfile_security_auth) or filter(f_localfile_security_authpriv); };
log {
    source(s_src);
    filter(f_localfile_security);
    destination(d_localfile_security);
    flags(flow-control);
};
# end of localFile: security

# localFile: user
destination d_localfile_user {
    program("/opt/local/bin/write_with_rotation.sh /var/log/user.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_user_user {
    facility(user) and level(info .. emerg);
};
filter f_localfile_user {
    filter(f_localfile_user_user); };
log {
    source(s_src);
    filter(f_localfile_user);
    destination(d_localfile_user);
    flags(flow-control);
};
# end of localFile: user

# localFile: alarm
destination d_localfile_alarm {
    program("/opt/local/bin/write_with_rotation.sh /var/log/alarm.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_alarm_local1 {
    facility(local1) and level(info .. emerg);
};
filter f_localfile_alarm {
    filter(f_localfile_alarm_local1); };
log {
    source(s_src);
    filter(f_localfile_alarm);
    destination(d_localfile_alarm);
    flags(flow-control);
};
# end of localFile: alarm

# localFile: cli-command
destination d_localfile_cli-command {
    program("/opt/local/bin/write_with_rotation.sh /var/log/cli-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_cli-command_match {
    match("<CLI>" value("MESSAGE"));
};
filter f_localfile_cli-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_cli-command_match);
};
filter f_localfile_cli-command {
    filter(f_localfile_cli-command_local3); };
log {
    source(s_src);
    filter(f_localfile_cli-command);
    destination(d_localfile_cli-command);
    flags(flow-control);
};
# end of localFile: cli-command

# localFile: configuration
destination d_localfile_configuration {
    program("/opt/local/bin/write_with_rotation.sh /var/log/configuration.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_configuration_local2 {
    facility(local2) and level(info .. emerg);
};
filter f_localfile_configuration {
    filter(f_localfile_configuration_local2); };
log {
    source(s_src);
    filter(f_localfile_configuration);
    destination(d_localfile_configuration);
    flags(flow-control);
};
# end of localFile: configuration

# localFile: event
destination d_localfile_event {
    program("/opt/local/bin/write_with_rotation.sh /var/log/event.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_event_local6 {
    facility(local6) and level(info .. emerg);
};
filter f_localfile_event {
    filter(f_localfile_event_local6); };
log {
    source(s_src);
    filter(f_localfile_event);
    destination(d_localfile_event);
    flags(flow-control);
};
# end of localFile: event

# localFile: linecard
destination d_localfile_linecard {
    program("/opt/local/bin/write_with_rotation.sh /var/log/linecard.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_linecard_local4 {
    facility(local4) and level(info .. emerg);
};
filter f_localfile_linecard {
    filter(f_localfile_linecard_local4); };
log {
    source(s_src);
    filter(f_localfile_linecard);
    destination(d_localfile_linecard);
    flags(flow-control);
};
# end of localFile: linecard

# localFile: netconf-command
destination d_localfile_netconf-command {
    program("/opt/local/bin/write_with_rotation.sh /var/log/netconf-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_netconf-command_match {
    match("<NETCONF>" value("MESSAGE"));
};
filter f_localfile_netconf-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_netconf-command_match);
};
filter f_localfile_netconf-command {
    filter(f_localfile_netconf-command_local3); };
log {
    source(s_src);
    filter(f_localfile_netconf-command);
    destination(d_localfile_netconf-command);
    flags(flow-control);
};
# end of localFile: netconf-command

# localFile: shell-command
destination d_localfile_shell-command {
    program("/opt/local/bin/write_with_rotation.sh /var/log/shell-command.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_shell-command_match {
    match("<SHELL>" value("MESSAGE"));
};
filter f_localfile_shell-command_local3 {
    facility(local3) and level(info .. emerg) and filter(f_localfile_shell-command_match);
};
filter f_localfile_shell-command {
    filter(f_localfile_shell-command_local3); };
log {
    source(s_src);
    filter(f_localfile_shell-command);
    destination(d_localfile_shell-command);
    flags(flow-control);
};
# end of localFile: shell-command

# localFile: sysinfo
destination d_localfile_sysinfo {
    program("/opt/local/bin/write_with_rotation.sh /var/log/sysinfo.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_sysinfo_local5 {
    facility(local5) and level(info .. emerg);
};
filter f_localfile_sysinfo {
    filter(f_localfile_sysinfo_local5); };
log {
    source(s_src);
    filter(f_localfile_sysinfo);
    destination(d_localfile_sysinfo);
    flags(flow-control);
};
# end of localFile: sysinfo

# localFile: ztp
destination d_localfile_ztp {
    program("/opt/local/bin/write_with_rotation.sh /var/log/ztp.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
filter f_localfile_ztp_match {
    match("<ZTP>" value("MESSAGE"));
};
filter f_localfile_ztp_local7 {
    facility(local7) and level(info .. emerg) and filter(f_localfile_ztp_match);
};
filter f_localfile_ztp {
    filter(f_localfile_ztp_local7); };
log {
    source(s_src);
    filter(f_localfile_ztp);
    destination(d_localfile_ztp);
    flags(flow-control);
};
# end of localFile: ztp


destination d_mgmt_vrf_socket {
    unix-stream("/dev/uds_log"
        flags(syslog-protocol, no-multi-line)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
log {
    source(s_src);
    rewrite(r_host);
    destination(d_mgmt_vrf_socket);
};