Cant make syslog work

Hi all,

I cannot get syslog messages show up in LibreNMS web interface.
I am probably missing something very basic, but I cannot figure out what.
This is what I am doing:

  1. Download the LibreNMS VM. (with only localhost as device)
  2. disable the firewall
  3. configure a client to send syslog to LibreNMS machine port 514
  4. tcpdump the traffic on port 514 (Traffic is there)
  5. configure syslog-ng to have multiple destinations:
########################
# Destinations
########################
destination d_librenms {
        program("/opt/librenms/syslog.php" template ("$HOST||$FACILITY||$PRIORITY||$LEVEL||$TAG||$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC||$MSG||$PROGRAM\n") template-escape(yes));
};

destination catchall {
	 file("/var/log/catchall.log");
};

########################
# Log paths
########################
log {
        source(s_net);
        source(s_sys);
        destination(d_librenms);
        destination(catchall);
};

I see logs coming and being written in my catchall file, but nothing shows up on libre.
I have also de-commented the line in /opt/librenms/syslog.php but I do not see anything in librenms.log.

What am I doing wrong? Can anybody help to fix/debug?

Here my validate:

[[email protected] ~]$ ./validate.php 
====================================
Component | Version
--------- | -------
LibreNMS  | 1.50.1
DB Schema | 2019_02_10_220000_add_dates_to_fdb (132)
PHP       | 7.2.16
MySQL     | 5.5.60-MariaDB
RRDTool   | 1.4.8
SNMP      | NET-SNMP 5.7.2
====================================

Thanks a lot!

Does it work without multiple destination? Can you try to comment out your catchall and restart syslog-ng ?

log {
        source(s_net);
        source(s_sys);
        destination(d_librenms);
#        destination(catchall);
};

Does the hostame you receive in your capture match that in librenms?

Hi Chas,
thank you for your answer!

“localhost” is the only device configured, also logs are coming from localhost.
If I remove the catchall file, syslog-ng works, but still I do not see any log in the WebUI or in the table syslog.
This functionality should work out of the box right?

Try replace the syslog-ng config with the one in here:

https://docs.librenms.org/Extensions/Syslog/

and ensure the enable syslog line is in your librenms config.php

I had the same issue with localhost and it was just that.

In LibreNMS I had localhost AS localhost, but the syslog-ng was sending data as the configured hostname in the machine itself.

So, localhost != host.domain.tld.

If your machine has librenms.domain.tld, change it in librenms to match that hostname.

Hi all,
thank you for your suggestions.
I double checked my syslog-ng configuration and it is the same as the one in the documentation.
(I am using the “official” LibreNMS VM for virtualbox. )
I confirm that syslog is enabled, in fact I see the syslog tab on the webUI.

[[email protected] librenms]# grep syslog /opt/librenms/config.php
$config["enable_syslog"] = 1;

About the hostnames:
Here are the logs from syslog:

May  7 07:35:01 localhost systemd[1]: Started Session 60 of user librenms.
May  7 07:35:01 localhost systemd[1]: Started Session 61 of user librenms.
May  7 07:35:01 localhost systemd[1]: Started Session 62 of user librenms.
May  7 07:35:01 localhost CROND[6430]: (librenms) CMD (   /opt/librenms/alerts.php >> /dev/null 2>&1)
May  7 07:35:01 localhost CROND[6431]: (librenms) CMD (   /opt/librenms/cronic /opt/librenms/poller-wrapper.py 4)
May  7 07:35:01 localhost CROND[6432]: (librenms) CMD (/opt/librenms/html/plugins/Weathermap/map-poller.php >> /dev/
May  7 07:35:01 localhost CROND[6434]: (librenms) CMD (   /opt/librenms/poll-billing.php >> /dev/null 2>&1)
May  7 07:35:01 localhost CROND[6435]: (librenms) CMD (   /opt/librenms/check-services.php >> /dev/null 2>&1)

here the configuration of the device:

MariaDB [librenms]> select device_id,hostname,sysName  from devices ;
+-----------+---------------+--------------------------+
| device_id | hostname      | sysName                  |
+-----------+---------------+--------------------------+
|         1 | localhost     | localhost.localdomain    |


I have also uncommented the following line in /opt/librenms/syslog.php:

[[email protected] librenms]# grep logfil syslog.php
    logfile($line);

Still, on the UI:
“No results found!” :frowning:

Hi all,
in the end I discovered the “problem” was in SELinux. Once disabled (setenforce 0) everything started to work properly.
I found the evidence in /var/log/audit/audit.log
I will post a more detailed fix (using SELinux in Enforcing) asap.
Thank you all.

I am having the same issue. Syslog was working fine for months on my Centos7 install then stopped. After much trial and error discovered it was SELinux. I am very interested in a permanent fix with SELinux enforced. Thanks!

Hi all,

sorry for the delay.
This seems to work for me:

#vi mycustom-librenms-rsyslog.te
  
  
module mycustom-librenms-rsyslog 1.0;

require {
        type syslogd_t;
        type httpd_sys_rw_content_t;
        type ping_exec_t;
        class process execmem;
        class dir { getattr search write };
        class file { append getattr execute open read };
}

#============= syslogd_t ==============
allow syslogd_t httpd_sys_rw_content_t:dir { getattr search write };
allow syslogd_t httpd_sys_rw_content_t:file { open read append getattr };
allow syslogd_t self:process execmem;
allow syslogd_t ping_exec_t:file execute;

  
  
  
  
#checkmodule -M -m -o mycustom-librenms-rsyslog.mod mycustom-librenms-rsyslog.te
#semodule_package -o mycustom-librenms-rsyslog.pp -m mycustom-librenms-rsyslog.mod
#semodule -i mycustom-librenms-rsyslog.pp



```

Hope it helps.
1 Like

Configuring LibreNMS Syslog with Rsyslog