Librenms no logging Syslog from cisco devices

Help
1

Hello there,

I just started to use libreNMS and for some reason is not showing any Syslog data.

centOS image in VMware.

Version 1.50.1 - Fri Apr 12 2019 21:47:50 GMT-0400
DB Schema 2019_02_10_220000_add_dates_to_fdb (132)
Web Server nginx/1.12.2
PHP 7.2.16
MySQL 5.5.60-MariaDB
RRDtool 1.4.8

Config validation passes ok.

checked that Syslog module is enable:

enable_syslog 1

syslog_filter
0 last message repeated
1 Connection from UDP: [
2 ipSystemStatsTable node ipSystemStatsOutFragOKs not implemented
3 diskio.c

syslog_purge 30

I have not make any changes other than adding the SNMP devices and configured to send syslog to the LibreNMS server.

devices where added by IP address not dns names and they show with the IP address on the device list.

doing a tcpdump in the libreNMS server I can see that the devices (cisco firepower and cisco wlc 2500) are sending the logs:

firepower:
sudo tcpdump -i eth0 host 10.10.4.6 and port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
20:02:16.707638 IP 10.10.4.6.syslog > localhost.localdomain.syslog: SYSLOG local4.info, length: 171
20:02:16.712619 IP 10.10.4.6.syslog > localhost.localdomain.syslog: SYSLOG local4.info, length: 151
20:02:16.776065 IP 10.10.4.6.syslog > localhost.localdomain.syslog: SYSLOG local4.info, length: 151
20:02:16.795550 IP 10.10.4.6.syslog > localhost.localdomain.syslog: SYSLOG local4.info, length: 171
20:02:16.811156 IP 10.10.4.6.syslog > localhost.localdomain.syslog: SYSLOG local4.info, length: 171
20:02:16.845974 IP 10.10.4.6.syslog > localhost.localdomain.syslog: SYSLOG local4.info, length: 171

wlc 2500:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
20:27:51.350977 IP 10.10.40.2.filenet-obrok > localhost.localdomain.syslog: SYSLOG local0.error, length: 189
20:27:51.351132 IP 10.10.40.2.filenet-obrok > localhost.localdomain.syslog: SYSLOG local0.error, length: 189

This is practically a default LibreNMS install using the CentOS provided image, is there anything else that needs to be done to see the Syslog messages in the server webUI?

Thanks in advance!

Jose H.

2

You need to configure syslog as well on the server. You should probably have a look here :
https://docs.librenms.org/Extensions/Syslog/

1 Like
3

Hello,

Thank you for the reply.

I have followed the steps listed in the document:
https://docs.librenms.org/Extensions/Syslog/

However when I do “sudo yum install syslog-ng” it shows that syslog is already installed

Package syslog-ng-3.5.6-3.el7.x86_64 already installed and latest version
Nothing to do

I have opened the file ‘syslog-ng.conf’ , but it looks pretty much the same, however I added:

filter f_kernel { facility(kern); };
filter f_default { level(info…emerg) and
not (facility(mail)
or facility(authpriv)
or facility(cron)); };
filter f_auth { facility(authpriv); };
filter f_mail { facility(mail); };
filter f_emergency { level(emerg); };
filter f_news { facility(uucp) or
(facility(news)
and level(crit…emerg)); };
filter f_boot { facility(local7); };
filter f_cron { facility(cron); };

After I restarted the service “sudo service syslog-ng restart”

I have checked that ‘config.php’ has the Syslog extension enabled:

$config[‘enable_syslog’] = 1;

Unfortunately, still same behavior. I can see the devices sending the logs messages to the server but still wont show up.

Is there anything else that needs to be added or modified on “syslog-ng.conf” do I need to specify in the file the devices?

Best regards,

4

I have tried everything I could find… we can see that the server is listening to port udp 514

[zmlman@localhost ~]$ sudo netstat -tulpn | grep 514
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 19585/syslog-ng
udp 0 0 0.0.0.0:514 0.0.0.0:* 19585/syslog-ng
udp 0 0 0.0.0.0:514 0.0.0.0:* 19585/syslog-ng
udp 0 0 0.0.0.0:514 0.0.0.0:* 19585/syslog-ng

Also, it seems that syslog-ng service is running:

sudo service syslog-ng status
Redirecting to /bin/systemctl status syslog-ng.service
● syslog-ng.service - System Logger Daemon
Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2019-04-26 19:24:43 UTC; 25min ago
Docs: man:syslog-ng(8)
Main PID: 19585 (syslog-ng)
CGroup: /system.slice/syslog-ng.service
├─ 7742 php /opt/librenms/syslog.php
└─19585 /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid

Apr 26 19:24:43 localhost.localdomain systemd[1]: Stopped System Logger Daemon.
Apr 26 19:24:43 localhost.localdomain systemd[1]: Starting System Logger Daemon…
Apr 26 19:24:43 localhost.localdomain systemd[1]: Started System Logger Daemon.

I ran out of ideas, any help will be greatly appreciated

5

Try to enable logging to a file on syslog-ng so you can validate syslog-ng does the job.
Could also have some permission issue in the script called by syslogng to ‘give’ the syslogs to Librenms.