Receive logs from router

mcgyver83 · 27. Dezember 2019

Hi, I'm running omv 4 on a raspberry. My router can send log to syslog server.
Checking logs in router gui is not so comfortable so I'm thinking of sending log to OMV instance to analyse them easily.

Do I need some config on omv? Or just set "Send to this Syslog server IP address" in the router admin page?

ryecoaaron · 27. Dezember 2019

rsyslog is not setup on OMV to receive messages. Easy to change though.

Just put the following lines in a file named /etc/rsyslog.d/incoming.conf

$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514

systemctl restart rsyslog

mcgyver83 · 28. Dezember 2019

Great!!! thanks!

How can I put these messages in a log file named router.log?

ryecoaaron · 28. Dezember 2019

create another file like /etc/rsyslog.d/10_router.conf with the following content:

if $hostname == 'change_to_routerhostname' then /var/log/router.log
& stop

Then restart rsyslog again.

mcgyver83 · 28. Dezember 2019

Code

/etc/rsyslog.d/10_router.conf

is the correct path, right?

With these 2 settings now I have these lines in router.log

Code

Dec 28 16:24:01 raspberrypi CRON[387]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 28 16:24:01 raspberrypi CRON[392]: (root) CMD (for i in `pgrep "ftpd|nfsiod|smbd|afpd|cnid"` ; do ionice -c1 -p $i ; done >/dev/null 2>&1)
Dec 28 16:24:01 raspberrypi CRON[387]: pam_unix(cron:session): session closed for user root
Dec 28 16:24:28 raspberrypi sshd[481]: Accepted publickey for pi from 192.168.0.13 port 54127 ssh2: RSA SHA256:CJSxNfqs71QD0lRZzN9S11Kg66l7Q8huW5OOr0EBxFE
Dec 28 16:24:28 raspberrypi sshd[481]: pam_unix(sshd:session): session opened for user pi by (uid=0)
Dec 28 16:24:28 raspberrypi systemd-logind[810]: New session c8 of user pi.
Dec 28 16:24:28 raspberrypi systemd[1]: Started Session c8 of user pi.

My desire is to have router log lines only in router.log file but now I have others log lines in router.log

ryecoaaron · 28. Dezember 2019

Zitat von mcgyver83

is the correct path, right?

Yep. Typo of course. Corrected.

Zitat von mcgyver83

My desire is to have router log lines only in router.log file but now I have others log lines in router.log

Ideally, the if statement should only put logs from that hostname in that file. I spend all day at work putting logs together on a remote server (splunk) not separating them into separate files. grep is easy to use. But I will look at why this is happening.

ryecoaaron · 28. Dezember 2019

It is working correctly on my system but the ordering of the conf files might be causing the issue. Change the name of the incoming.conf file to 10_incoming.conf and the router file to 20_router.conf. Then restart rsyslog.

mcgyver83 · 28. Dezember 2019

I changed conf files addig 10_ and 20_ but this is what happens when I log into router webGui

Code

==> /var/log/router.log <==
Dec 28 18:30:01 raspberrypi CRON[13375]: (root) CMD (for i in `pgrep "ftpd|nfsiod|smbd|afpd|cnid"` ; do ionice -c1 -p $i ; done >/dev/null 2>&1)
Dec 28 18:30:02 raspberrypi CRON[13371]: pam_unix(cron:session): session closed for user root


Message from syslogd@gateway at Dec 28 18:30:02 ...
 kernel: [SysLog]: [Admin login] from source 192.168.0.13,


==> /var/log/user.log <==
Dec 28 18:30:01 gateway kernel: [SysLog]: [Admin login] from source 192.168.0.13,
Dec 28 18:30:01 gateway syslog: [Admin login] from source 192.168.0.13,


==> /var/log/syslog <==
Dec 28 18:30:01 gateway kernel: [SysLog]: [Admin login] from source 192.168.0.13,
Dec 28 18:30:01 gateway syslog: [Admin login] from source 192.168.0.13,


==> /var/log/messages <==
Dec 28 18:30:01 gateway syslog: [Admin login] from source 192.168.0.13,


Message from syslogd@gateway at Dec 28 18:30:03 ...
 kernel: [SysLog]: [Admin login] from source 192.168.0.13,


==> /var/log/user.log <==
Dec 28 18:30:02 gateway kernel: [SysLog]: [Admin login] from source 192.168.0.13,
Dec 28 18:30:02 gateway syslog: [Admin login] from source 192.168.0.13,


==> /var/log/syslog <==
Dec 28 18:30:02 gateway kernel: [SysLog]: [Admin login] from source 192.168.0.13,
Dec 28 18:30:02 gateway syslog: [Admin login] from source 192.168.0.13,


==> /var/log/messages <==
Dec 28 18:30:02 gateway syslog: [Admin login] from source 192.168.0.13,


Message from syslogd@gateway at Dec 28 18:30:11 ...
 kernel: [SysLog]: [DHCP IP: (192.168.0.51)] to MAC address AA:BB:CC:2E:97:E3,


==> /var/log/user.log <==
Dec 28 18:30:10 gateway kernel: [SysLog]: [DHCP IP: (192.168.0.51)] to MAC address AA:BB:CC:2E:97:E3,


==> /var/log/syslog <==
Dec 28 18:30:10 gateway kernel: [SysLog]: [DHCP IP: (192.168.0.51)] to MAC address AA:BB:CC:2E:97:E3,


==> /var/log/router.log <==
Dec 28 18:30:12 raspberrypi monit[1339]: Device /srv/abcdef7feebcb not found in /etc/mtab
Dec 28 18:30:12 raspberrypi monit[1339]: 'mountpoint_srv_abcdfeea44-37dd37feebcb' status failed (1) -- mountpoint: /srv/asdsadffff-9a44-37dd37feebcb: Not a directory


Message from syslogd@gateway at Dec 28 18:30:13 ...
 kernel: [SysLog]: [DHCP IP: (192.168.0.52)] to MAC address AA:BB:CC:2E:98:EB,


==> /var/log/user.log <==
Dec 28 18:30:12 gateway kernel: [SysLog]: [DHCP IP: (192.168.0.52)] to MAC address AA:BB:CC:2E:98:EB,


==> /var/log/syslog <==
Dec 28 18:30:12 gateway kernel: [SysLog]: [DHCP IP: (192.168.0.52)] to MAC address AA:BB:CC:2E:98:EB,

Alles anzeigen

As you can see the router message is written in more files

And in router.log I have lines not coming from router

Code

==> /var/log/router.log <==
Dec 28 18:31:44 raspberrypi monit[1339]: Device /srv/2301d0e4-a1b6-41ff-9a44-37dd37feebcb not found in /etc/mtab
Dec 28 18:31:44 raspberrypi monit[1339]: 'mountpoint_srv_2301d0e4-a1b6-41ff-9a44-37dd37feebcb' status failed (1) -- mountpoint: /srv/2301d0e4-a1b6-41ff-9a44-37dd37feebcb: Not a directory
Dec 28 18:32:01 raspberrypi CRON[14191]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 28 18:32:01 raspberrypi CRON[14195]: (root) CMD (for i in `pgrep "ftpd|nfsiod|smbd|afpd|cnid"` ; do ionice -c1 -p $i ; done >/dev/null 2>&1)
Dec 28 18:32:01 raspberrypi CRON[14191]: pam_unix(cron:session): session closed for user root
Dec 28 18:32:14 raspberrypi monit[1339]: Device /srv/2301d0e4-a1b6-41ff-9a44-37dd37feebcb not found in /etc/mtab
Dec 28 18:32:14 raspberrypi monit[1339]: 'mountpoint_srv_2301d0e4-a1b6-41ff-9a44-37dd37feebcb' status failed (1) -- mountpoint: /srv/2301d0e4-a1b6-41ff-9a44-37dd37feebcb: Not a directory
Dec 28 18:32:45 raspberrypi monit[1339]: Device /srv/2301d0e4-a1b6-41ff-9a44-37dd37feebcb not found in /etc/mtab
Dec 28 18:32:45 raspberrypi monit[1339]: 'mountpoint_srv_2301d0e4-a1b6-41ff-9a44-37dd37feebcb' status failed (1) -- mountpoint: /srv/2301d0e4-a1b6-41ff-9a44-37dd37feebcb: Not a directory
Dec 28 18:33:01 raspberrypi CRON[14539]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 28 18:33:01 raspberrypi CRON[14543]: (root) CMD (for i in `pgrep "ftpd|nfsiod|smbd|afpd|cnid"` ; do ionice -c1 -p $i ; done >/dev/null 2>&1)
Dec 28 18:33:01 raspberrypi CRON[14539]: pam_unix(cron:session): session closed for user root

Alles anzeigen

gderf · 28. Dezember 2019

Why don't you post the contents of the file you created for this, /etc/rsyslog.d/10_router.conf or /etc/rsyslog.d/20_router.conf, perhaps there is some error in them?

mcgyver83 · 28. Dezember 2019

Code

pi@raspberrypi:/etc/rsyslog.d$ cat 10_incoming.conf
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514

Code

pi@raspberrypi:/etc/rsyslog.d$ cat 20_router.conf
if $hostname == 'raspberrypi' then /var/log/router.log
& stop

gderf · 28. Dezember 2019

Zitat von mcgyver83

Code

pi@raspberrypi:/etc/rsyslog.d$ cat 20_router.conf
if $hostname == 'raspberrypi' then /var/log/router.log
& stop

For $hostname you should be using the router hostname, not the hostname of the machine accepting the logs.

mcgyver83 · 28. Dezember 2019

Sorry, you're right.

I'm looking for router hostname in the webGui...
Could I use the ip address?

gderf · 28. Dezember 2019

I believe an IP address would work, but $hostname might not be correct.

Try:

$fromhost-ip == 'a.b.c.d'

mcgyver83 · 28. Dezember 2019

Great.
works fine now!

Many many many thanks

I tried a bunch of times to study rsyslog configuration but is really hard

mcgyver83 · 21. Februar 2020

Hi, again on this topic
How can I setup log rotation and retention for all logs in /var/log folder?

Jetzt mitmachen!