This section provides details about syslog forwarding, including server and client installation commands. Use it to understand how Cisco Optical Network Controller forwards application logs to a syslog server.
Use this reference to understand syslog forwarding configuration.
Syslog forwarding configuration includes:
-
The syslog forwarding feature help in:.
-
Storing logs from the client VMs in the server VM.
-
Allowing multiple client VMs to send logs to the same server VM.
-
Server installation is done only once.
-
The server's database stores all logs.
-
You need to run the commands from the client VMs to configure the server using the script provided.
Install syslog on server
To install syslog feature on the server run the CLI commands given in the example:.
Create the rsyslog server using steps provided in below website
https://www.makeuseof.com/set-up-linux-remote-logging-using-rsyslog/
To create the folder structure
AUDIT logs here → /var/log/<host-ip>/audit.log
ONC service logs here → /var/log/<host-ip>/service_logs/
Add the below lines in the rsyslog.conf file
$ModLoad imudp
$UDPServerRun 514
Input (type="imudp" port="514" ruleset="rs1")
template (name="ServLogLoc" type="string" string="/var/log/%FROMHOST-IP%/service_logs/%syslogtag%.log")
template (name="AuditLogLoc" type="string" string="/var/log/%FROMHOST-IP%/audit.log")
Ruleset (name="rs1") {
:msg, contains, "audit" ?AuditLogLoc
*.* ?ServLogLoc
}
Restart syslog server using command,
systemctl restart rsyslog
Check if rsyslog service is active and running using command,
systemctl status rsyslog
Install syslog on client
Install syslog on client includes:
-
To install syslog server forwarding in client run the CLI commands in the example:.
-
To create a syslog query to forward the apllication logs of a particular Cisco Optical Network Controller app:.
-
The query inside single quotes is Grafana Loki's logQL, it can be tweaked according to user needs.
-
To list all syslog queries:.
-
To list all syslog servers:.
-
To delete a syslog query:.
-
To delete a syslog server:.
sedo syslog server create <IP> <PROTOCOL> <IP> <PORT>
IP is the address of the syslog server.
Protocol to be used - udp or tcp.
Port on which syslog server is listening to (default is 514)
sedo syslog query create '{namespace="onc", app="<app_name>", container="app"}' LOG_INFO LOG_USER <app_name> <IP>
The query inside single quotes is Grafana Loki's logQL, it can be tweaked according to user needs
sedo syslog query list
sedo syslog server list
sedo syslog query delete <QUERY_ID>
sedo syslog server delete <IP>