Hi All,
I'm having trouble to get the rsyslog working.
I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% .
And rebooted rsyslog service.
When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database.
Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]:
config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE;
syslog.php logfile('logs/debug.log', $line);
debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435):
Can someone please advice to get this working.
Thanks
In DB are stored syslog entries only from remote devices (udp), not from local system.
On Thu, Jan 22, 2015 at 10:36 AM, Patrick Marquetecken < patrick@marquetecken.be> wrote:
Hi All,
I'm having trouble to get the rsyslog working.
I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% .
And rebooted rsyslog service.
When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database.
Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]:
config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE;
syslog.php logfile('logs/debug.log', $line);
debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435):
Can someone please advice to get this working.
Thanks
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Mike,
here is my rsyslog.conf
# Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514
# Provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514
So I only going to receive UDP messages as said in the wiki setup
[root@mon-02 ~]# ls /etc/rsyslog.d/ 30-observium.conf
#--------------------------------------------------------- #send remote logs to observium
$template observium,"%fromhost-ip%||%syslogfacility%||%syslogpriority%||%syslogseverity%||%syslogtag%||%$year%-%$month%-%$day% %timereported:8:25%||%msg%||%programname%\n"
$ModLoad omprog $ActionOMProgBinary /opt/observium/syslog.php
:inputname, isequal, "imudp" :omprog:;observium
& ~ #---------------------------------------------------------
Mike Stupalov schreef op 22/01/15 om 09:04:
In DB are stored syslog entries only from remote devices (udp), not from local system.
On Thu, Jan 22, 2015 at 10:36 AM, Patrick Marquetecken <patrick@marquetecken.be mailto:patrick@marquetecken.be> wrote:
Hi All, I'm having trouble to get the rsyslog working. I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% . And rebooted rsyslog service. When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database. Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]: config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE; syslog.php logfile('logs/debug.log', $line); debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435): Can someone please advice to get this working. Thanks _______________________________________________ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium-- Mike Stupalov http://observium.org/
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
On 22.01.2015 11:13, Patrick Marquetecken wrote:
Mike,
here is my rsyslog.conf
# Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514
# Provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514
So I only going to receive UDP messages as said in the wiki setup
[root@mon-02 ~]# ls /etc/rsyslog.d/ 30-observium.conf
#--------------------------------------------------------- #send remote logs to observium
$template observium,"%fromhost-ip%||%syslogfacility%||%syslogpriority%||%syslogseverity%||%syslogtag%||%$year%-%$month%-%$day% %timereported:8:25%||%msg%||%programname%\n"
$ModLoad omprog $ActionOMProgBinary /opt/observium/syslog.php
:inputname, isequal, "imudp" :omprog:;observium
& ~ #---------------------------------------------------------
Check that your server really receives any syslog messages over UDP:
$ sudo tcpdump -n 'proto UDP and port 514'
Mike Stupalov schreef op 22/01/15 om 09:04:
In DB are stored syslog entries only from remote devices (udp), not from local system.
On Thu, Jan 22, 2015 at 10:36 AM, Patrick Marquetecken <patrick@marquetecken.be mailto:patrick@marquetecken.be> wrote:
Hi All, I'm having trouble to get the rsyslog working. I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% . And rebooted rsyslog service. When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database. Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]: config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE; syslog.php logfile('logs/debug.log', $line); debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435): Can someone please advice to get this working. Thanks _______________________________________________ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium-- Mike Stupalov http://observium.org/
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Mike,
Ok, I had activated the tcp forwarding @@ and not the upd @ from the remote servers.
When I do a tcpdump -i eth0 udp port 514 I see now 3 servers sending there information.
smtp-01, fw-01 and web-01
09:33:36.456070 IP smtp-01.58878 > mon-02.syslog: SYSLOG local4.debug, length: 63 09:33:37.194493 IP fw-01.48762 > mon-02.syslog: SYSLOG kernel.info, length: 212 09:40:01.295382 IP web-01.53940 > mon-02.syslog: SYSLOG cron.info, length: 75
I can see the syslogs now for the server snmp-01 (perfect) but for server fw-01, and web-01 I don't see anything in Observium.
the names of those server are excact as in the device table hostname.
Any idea how to debug this ?
Mike Stupalov schreef op 22/01/15 om 09:04:
In DB are stored syslog entries only from remote devices (udp), not from local system.
On Thu, Jan 22, 2015 at 10:36 AM, Patrick Marquetecken <patrick@marquetecken.be mailto:patrick@marquetecken.be> wrote:
Hi All, I'm having trouble to get the rsyslog working. I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% . And rebooted rsyslog service. When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database. Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]: config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE; syslog.php logfile('logs/debug.log', $line); debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435): Can someone please advice to get this working. Thanks _______________________________________________ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium-- Mike Stupalov http://observium.org/
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
On 22.01.2015 11:43, Patrick Marquetecken wrote:
Mike,
Ok, I had activated the tcp forwarding @@ and not the upd @ from the remote servers.
When I do a tcpdump -i eth0 udp port 514 I see now 3 servers sending there information.
smtp-01, fw-01 and web-01
09:33:36.456070 IP smtp-01.58878 > mon-02.syslog: SYSLOG local4.debug, length: 63 09:33:37.194493 IP fw-01.48762 > mon-02.syslog: SYSLOG kernel.info, length: 212 09:40:01.295382 IP web-01.53940 > mon-02.syslog: SYSLOG cron.info, length: 75
I can see the syslogs now for the server snmp-01 (perfect) but for server fw-01, and web-01 I don't see anything in Observium.
the names of those server are excact as in the device table hostname.
Any idea how to debug this ?
When you use %fromhost-ip%, correct device detected by IP address from DB. Then this IP addresses should be founded in "ipv4/6-addresses" discovery modules. You can check that this diveces have IP addresses in "Search IP addresses" page: http://observium/search/search=ipv4/
Mike Stupalov schreef op 22/01/15 om 09:04:
In DB are stored syslog entries only from remote devices (udp), not from local system.
On Thu, Jan 22, 2015 at 10:36 AM, Patrick Marquetecken <patrick@marquetecken.be mailto:patrick@marquetecken.be> wrote:
Hi All, I'm having trouble to get the rsyslog working. I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% . And rebooted rsyslog service. When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database. Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]: config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE; syslog.php logfile('logs/debug.log', $line); debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435): Can someone please advice to get this working. Thanks _______________________________________________ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium-- Mike Stupalov http://observium.org/
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Mike,
It's working apparently is was just inpatient.
Thanks for your help.
Patrick
Mike Stupalov schreef op 22/01/15 om 10:31:
On 22.01.2015 11:43, Patrick Marquetecken wrote:
Mike,
Ok, I had activated the tcp forwarding @@ and not the upd @ from the remote servers.
When I do a tcpdump -i eth0 udp port 514 I see now 3 servers sending there information.
smtp-01, fw-01 and web-01
09:33:36.456070 IP smtp-01.58878 > mon-02.syslog: SYSLOG local4.debug, length: 63 09:33:37.194493 IP fw-01.48762 > mon-02.syslog: SYSLOG kernel.info, length: 212 09:40:01.295382 IP web-01.53940 > mon-02.syslog: SYSLOG cron.info, length: 75
I can see the syslogs now for the server snmp-01 (perfect) but for server fw-01, and web-01 I don't see anything in Observium.
the names of those server are excact as in the device table hostname.
Any idea how to debug this ?
When you use %fromhost-ip%, correct device detected by IP address from DB. Then this IP addresses should be founded in "ipv4/6-addresses" discovery modules. You can check that this diveces have IP addresses in "Search IP addresses" page: http://observium/search/search=ipv4/
Mike Stupalov schreef op 22/01/15 om 09:04:
In DB are stored syslog entries only from remote devices (udp), not from local system.
On Thu, Jan 22, 2015 at 10:36 AM, Patrick Marquetecken <patrick@marquetecken.be mailto:patrick@marquetecken.be> wrote:
Hi All, I'm having trouble to get the rsyslog working. I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% . And rebooted rsyslog service. When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database. Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]: config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE; syslog.php logfile('logs/debug.log', $line); debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435): Can someone please advice to get this working. Thanks _______________________________________________ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium-- Mike Stupalov http://observium.org/
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
-- Mike Stupalov http://observium.org
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Hi Patrick,
no you are not impatient. ;-)
Following the Observium documentation forwards only syslog messages recieved by udp to observium. The crux is the given Message Filter for rsyslog. Which is for rsyslog version prior 5.n. btw. Which says if the inputname is equal to "imudp" execute the module omprog with the message template observium _and_ do not process messages that matched that rule any further. imudp is the name of the Module you have loaded before with $ModLoad imudp.
With rsyslog version 5 or later you can use, eg, this instead:
if $fromhost-ip startswith 'aaa.bbb.nnn' then action(type="omprog" binary="/opt/observium/syslog.php" template="observium")
Just change the filter condition to selecte the messages you want to forward to the observium database. Which means you can also forward local messages... ;)
g Karsten
From: Patrick Marquetecken patrick@marquetecken.be To: Observium Network Observation System observium@observium.org Date: 22.01.2015 10:51 Subject: Re: [Observium] Problem with rsyslog configuration Sent by: "observium" observium-bounces@observium.org
Mike,
It's working apparently is was just inpatient.
Thanks for your help.
Patrick
Mike Stupalov schreef op 22/01/15 om 10:31: On 22.01.2015 11:43, Patrick Marquetecken wrote: Mike,
Ok, I had activated the tcp forwarding @@ and not the upd @ from the remote servers.
When I do a tcpdump -i eth0 udp port 514 I see now 3 servers sending there information.
smtp-01, fw-01 and web-01
09:33:36.456070 IP smtp-01.58878 > mon-02.syslog: SYSLOG local4.debug, length: 63 09:33:37.194493 IP fw-01.48762 > mon-02.syslog: SYSLOG kernel.info, length: 212 09:40:01.295382 IP web-01.53940 > mon-02.syslog: SYSLOG cron.info, length: 75
I can see the syslogs now for the server snmp-01 (perfect) but for server fw-01, and web-01 I don't see anything in Observium.
the names of those server are excact as in the device table hostname.
Any idea how to debug this ?
When you use %fromhost-ip%, correct device detected by IP address from DB. Then this IP addresses should be founded in "ipv4/6-addresses" discovery modules. You can check that this diveces have IP addresses in "Search IP addresses" page: http://observium/search/search=ipv4/
Mike Stupalov schreef op 22/01/15 om 09:04: In DB are stored syslog entries only from remote devices (udp), not from local system.
On Thu, Jan 22, 2015 at 10:36 AM, Patrick Marquetecken < patrick@marquetecken.be> wrote: Hi All,
I'm having trouble to get the rsyslog working.
I have followed the guide http://www.observium.org/wiki/Rsyslog_Syslog_Server but used the %fromhost-ip% .
And rebooted rsyslog service.
When I do a tail of /var/log/messages (i'm using a centos 6.4) I see the log files from my others server coming in, but none is going to the database.
Jan 22 08:31:12 smtp postfix/anvil[6320]: Jan 22 08:27:38 app-05 postfix/postqueue[28297]: Jan 22 08:31:24 db-02 postfix/postqueue[25382]: Jan 22 07:52:56 fw-01 postfix/postqueue[18540]: Jan 22 08:31:36 proxy-01 postfix/postqueue[16781]: Jan 22 08:31:40 app-01 postfix/postqueue[17602]: Jan 22 08:31:39 db-01 postfix/postqueue[17506]: Jan 22 08:28:06 voip-02 postfix/postqueue[29870]: Jan 22 08:27:48 nas-02 postfix/postqueue[30007]:
config.php $config['enable_syslog'] = 1; $config['syslog']['fifo'] = FALSE; $config['syslog']['debug'] = TRUE;
syslog.php logfile('logs/debug.log', $line);
debug.log This file stays empty unless i run syslog.php at hand then I see this: [2015/01/20 17:03:31 +0100] syslog.php(15435):
Can someone please advice to get this working.
Thanks
_______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (3)
-
Karsten Schwarz -
Mike Stupalov -
Patrick Marquetecken