Install rsyslog
dnf install rsyslog -y
Edit the journald log.
vi /etc/systemd/journald.conf
Add, enable, or modify the following lines.
ForwardToSyslog=yes MaxLevelSyslog=debug
Enable and start rsyslog
systemctl enable rsyslog
systemctl start rsyslog
We’ll follow the documentation from here.
Changes are made to the /etc/rsyslog.conf config file.
For this example, we will be configuring our named.log file to not exceed 50MiB, and then we’ll have a rotated log “.1” that is also 50MiB. Total it should not exceed 100BMiB.
First we need to create an out channel, and then we assign the out channel to a logging channel. We also need a script that rotates the logs.
$outchannel log_rotation,/var/log/named.log, 52428800,/home/user/log_rotation.sh
On our line that is logging named, at the end add :$log_rotation
Example:
local0.* /var/log/named.log:$log_rotation
Somewhere on the system, create a rotate.sh script. Name it whatever you want, just be sure the path and name in the rsyslog.conf is the same.
Add the following one line to move the current log to a rotate log.
mv -f /var/log/named.log /var/log/named.log.1
As the log fills up and hits ~50MiB, the named.sh script will run which rotates(moves) the log file to logfile.log.1. This will keep our usage for named.log to 100MiB.
The problem: Linux servers have been configured to send their local syslogs to LibreNMS, but are not showing up under the LibreNMS -> DEVICE -> Logs-> Syslog
After a bit of troubleshooting, found that the issue is the hostname being sent with the logs is different than what LibreNMS has for the device. It appears that some Linux distributions will or can use an abbreviated system hostname. There is a section in the LibreNMS docs about this
https://docs.librenms.org/Extensions/Syslog/#matching-syslogs-to-hosts-with-different-names
We can either do what the docs say, or we can set the host name in the rsyslog.conf file on each of the servers.
Log into the server and open up
sudo vi /etc/rsyslog.conf
At the very top, add the following line to set the hostname
$LocalHostName host.server_name_fqdn.com
Save the file and restart rsyslog
sudo systemctl restart rsyslog
Refresh the page to verify the logs are showing up in LibreNMS.
If you are still having issues, you may want to check the following
Using the LibreNMS documentation for setting up syslog-ng so LibreNMS can ingest logs from Cisco, Mikrotik, Ubiquiti etc. equipment.
https://docs.librenms.org/Extensions/Syslog/
First thing we need to do is enable syslog for LibreNMS. Edit the /opt/librenms/config.php and add or enable
$config['enable_syslog'] = 1;
Install syslog-ng with dnf or yum.
sudo dnf install -y syslog-ng
Create a config file for LibreNMS
vi /etc/syslog-ng/conf.d/librenms.conf
Put the following in the config file
source s_net {
tcp(port(514) flags(syslog-protocol));
udp(port(514) flags(syslog-protocol));
};
destination d_librenms {
program("/opt/librenms/syslog.php" template ("$HOST||$FACILITY||$PRIORITY||$LEVEL||$TAG||$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC||$MSG||$PROGRAM\n") template-escape(yes));
};
log {
source(s_net);
source(s_sys);
destination(d_librenms);
};
Restart and enable syslog-ng
sudo systemctl restart syslog-ng sudo systemctl enable syslog-ng
If we are running SELinux, we’ll need to make and apply a module to let the logs show up in the web interface.
vi librenms-rsyslog.te
Put the following in the file
module mycustom-librenms-rsyslog 1.0;
require {
type syslogd_t;
type httpd_sys_rw_content_t;
type ping_exec_t;
class process execmem;
class dir { getattr search write };
class file { append getattr execute open read };
}
#============= syslogd_t ==============
allow syslogd_t httpd_sys_rw_content_t:dir { getattr search write };
allow syslogd_t httpd_sys_rw_content_t:file { open read append getattr };
allow syslogd_t self:process execmem;
allow syslogd_t ping_exec_t:file execute;
Now run the following commands to make and apply our SELinux module.
checkmodule -M -m -o librenms-rsyslog.mod librenms-rsyslog.te semodule_package -o librenms-rsyslog.pp -m librenms-rsyslog.mod sudo semodule -i librenms-rsyslog.pp
First we need to drop into configuration mode
conf t
Now we run the following command. Change ip-address to the address of you remote syslog server.
logging host ip-address
You will want to make sure that your time/timezone is correct.
Change UTC and 0 to your your timezone and how many hours off UTC you are. For example for EST you would do EST -5
clock timezone UTC 0
Adding the following option to the config.php file is supposed to delete anything over 30 days.
$config['syslog_purge'] = 30;You can also manually delete the entries out of the MySQL database by logging into MySQL, selecting the librenms database, and running the command below.
The command deletes all entries older than 12/9/2018 at 08:00. Change the date and time as needed.
DELETE FROM syslog WHERE timestamp < '2018-12-9 08:00:00';
The following link has some more clean up options.
https://docs.librenms.org/Support/Cleanup-options/