| 1 | Advanced Registry Operations Curriculum |
|---|
| 2 | |
|---|
| 3 | Using syslog-ng |
|---|
| 4 | |
|---|
| 5 | 1. Install syslog-ng |
|---|
| 6 | |
|---|
| 7 | # apt-get install syslog-ng |
|---|
| 8 | |
|---|
| 9 | 2. Edit /etc/syslog-ng/syslog-ng.conf |
|---|
| 10 | |
|---|
| 11 | Find the lines: |
|---|
| 12 | |
|---|
| 13 | # (this is equivalent to the "-r" syslogd flag) |
|---|
| 14 | # udp(); |
|---|
| 15 | |
|---|
| 16 | and change it to: |
|---|
| 17 | |
|---|
| 18 | # (this is equivalent to the "-r" syslogd flag) |
|---|
| 19 | udp(); |
|---|
| 20 | |
|---|
| 21 | At the bottom of the file, add: |
|---|
| 22 | |
|---|
| 23 | filter f_routers { facility(local5); }; |
|---|
| 24 | log { |
|---|
| 25 | source(s_all); |
|---|
| 26 | filter(f_routers); |
|---|
| 27 | destination(routers); |
|---|
| 28 | }; |
|---|
| 29 | destination routers { |
|---|
| 30 | file("/var/log/network/$YEAR/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY-$HOUR.log" |
|---|
| 31 | owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes) |
|---|
| 32 | template("$YEAR $DATE $HOST $MSG\n")); |
|---|
| 33 | }; |
|---|
| 34 | |
|---|
| 35 | 3. Create the directory /var/log/network/ |
|---|
| 36 | |
|---|
| 37 | # mkdir /var/log/network/ |
|---|
| 38 | |
|---|
| 39 | 4. Restart syslog-ng: |
|---|
| 40 | |
|---|
| 41 | # /etc/init.d/syslog-ng restart |
|---|
| 42 | |
|---|
| 43 | 5. Configure your virtual routers to send syslog messages to your server: |
|---|
| 44 | |
|---|
| 45 | (Note: since you are working with 1 router / multiple TLDs, you will need |
|---|
| 46 | to configure your router send to multiple hosts: |
|---|
| 47 | |
|---|
| 48 | Hint: Use rancid clogin! |
|---|
| 49 | |
|---|
| 50 | rtrX# config terminal |
|---|
| 51 | rtrX(config)# logging tld1 |
|---|
| 52 | rtrX(config)# logging tld2 |
|---|
| 53 | rtrX(config)# logging facility local5 |
|---|
| 54 | rtrX(config)# logging userinfo |
|---|
| 55 | rtrX(config)# exit |
|---|
| 56 | rtrX# write |
|---|
| 57 | ... |
|---|
| 58 | rtrX# copy running-config flash:running-config |
|---|
| 59 | |
|---|
| 60 | logout from the router (exit) |
|---|
| 61 | |
|---|
| 62 | 6. On your PC, See if messages are starting to appear under |
|---|
| 63 | |
|---|
| 64 | /var/log/network/2010/02/26/... |
|---|
| 65 | |
|---|
| 66 | 7. If not, try to login back into the router, and run some "config" commands, |
|---|
| 67 | then logout. |
|---|