Date: Wed, 13 Jul 2016 10:09:20 +0200 From: "O. Hartmann" <ohartman@zedat.fu-berlin.de> To: freebsd-current <freebsd-current@freebsd.org> Subject: Re: syslog: not logging for remote host Message-ID: <20160713100920.66e3da8c@freyja.zeit4.iv.bundesimmobilien.de> In-Reply-To: <20160713095343.4c41ff9a@freyja.zeit4.iv.bundesimmobilien.de> References: <20160713095343.4c41ff9a@freyja.zeit4.iv.bundesimmobilien.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 13 Jul 2016 09:53:43 +0200 "O. Hartmann" <ohartman@zedat.fu-berlin.de> wrote: > I have some serious trouble logging for remote hosts via syslog on a sepcific > central server. > > Following manpages syslogd(8) and syslog.conf(5), the syslogd is allowed to > listen on a specific address (-b option) and receiving syslog messages from > remote client hosts on a specific network (-a option). Our configuration of > syslogd looks like (rc.conf): > > syslogd_flags="-8 -n -v -4 -C -b 192.168.0.2:514 -a 192.168.0.1/24:*" > > and sockstat show a proper listening port: > > [...] > root syslogd 75823 6 udp4 192.168.0.2:514 *:* > > Now the strange or weird part (in my opinion). > > We have several firewalls, gateways, APs and printers which are configured to > send syslog messages to a remote host, designated by the IP shown above. This > works, I can see syslogd receiving messages from several systems > via /var/log/messages (at the moment everything is also dumped into that file > as well as onto console, on which the messages from the remote devices also > appear as expected. > > In /etc/syslog.conf I try to use the fowllowing line, for instance for one > device as pars pro totum, to log to a dedicated file: > > [...] > +192.168.0.100 > *.* /var/log/printer-01.log > +192.168.0.101 > *.* /var/log/printer-02.log > !* > (EOF) > > All log definitions for remote host logging are put to the end of file > syslog.conf to avoid problems with the block boundaries. So the above shown > config should separate each different host in a defined way as the manpage > syslog.conf(5) states. > > Using IPs only seems not to work (and I can not understand, according to > syslogd(8) and option -a ipaddr/msklen:port). I never get a delegation of > log messages into the specified file. > > So, syslog.conf(5) states that I have to use "names". So I also > setup /etc/hosts to have each remote host's IP assigned with a hostname (we > have no domain/DNS in this specific network, IP only!). So I tried then > > [...] > +printer-01 > *.* /var/log/printer-01.log > +printer02 > *.* /var/log/printer-02.log > !* > (EOF) > > This doesn't work either! > > Something is very fishy with FreeBSD's syslogd and please let me know what I'm > doing wrong here. > > I also read the section in the handbook about remote syslog and the > requirement of a forward and reverse DNS resolution - which is NOT(!) > mentioned in the manpages (and I follow the opinion that in doubt, the > manpage is right!). > > Can someone shed a bit light on that (no, I do not want to use a ports > package/alternative syslog, I'd like to use FreeBSD's tools already abord). > > Thank you very much in advance and apologizes to those who feel bothered by a > possible stupid question! > > regards, > > O. Hartmann > > _______________________________________________ > freebsd-current@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org" I found this message left five years ago, coinciding with my experience, that when I used this loggin method last time, that was FreeBSD 8.X and early 9.X, it worked for IPs as shown; https://lists.freebsd.org/pipermail/freebsd-questions/2011-November/235565.html
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160713100920.66e3da8c>