Monday, May 29, 2017

Syslog not forwarding remote messages

Leave a Comment

I configured /etc/syslog.conf with below configuration

*.* @10.10.10.2:514 *.* @@10.10.10.2:514 

and logged through below code

openlog("Test-Msg", LOG_PID, LOG_LOCAL0); for (int i = 0; i <10; i++) {     syslog(LOG_ALERT, "My msg %d", i);     std::cout<<"-------------Writing Syslog "<<i<<"\n"; }  closelog(); 

but its not forwarding to remote server. instead of that it creates a file "@10.10.10.2:514" & "@@10.10.10.2:514" and logging all the message there.

Tested with wireshark, no messages are forwarded to remote system.

I am using yocto platform and busybox 1.22 syslog implementation.

Update

In yocto I saw one more configuration file /etc/syslog-startup.conf and there I configured

DESTINATION=remote  # log destinations (buffer file remote) REMOTE=10.10.10.2:514          # where to log (syslog remote) 

Now its started forwarding all the messages, but as per the linux manuals syslog conf must support *.=alert @<host:port> filter. If I have to use the above configuration how can I apply the filters?

2 Answers

Answers 1

By default Yocto-based systems use Busybox to provide minimal versions of many basic tools. syslog is one of those tools. This is a quote from Busybox documentation:

Note that this version of syslogd ignores /etc/syslog.conf.

To get full syslog functionality you'd have to include a more complete implementation on your image. There are several options in meta-openembedded, rsyslog in meta-oe is probably a good default choice.

Answers 2

I would first use logger (tool incluided in busybox) to ensure that your syslog configuration is correct. If the messages are sent well by this method, then we can investigate the code.

logger [OPTIONS] [MESSAGE]  Write MESSAGE to the system log. If MESSAGE is omitted, log stdin.  Options:          -s      Log to stderr as well as the system log         -t TAG  Log using the specified tag (defaults to user name)         -p PRIO Priority (numeric or facility.level pair) 
If You Enjoyed This, Take 5 Seconds To Share It

0 comments:

Post a Comment