Running OSX as a syslog server
I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as a syslog server but the Console shows nothing under /var/log/network (though the directory does show).
The steps I've taken:
- Set the IP of my laptop in the router's admin page for syslogging.
- Updated the syslog plist to listen on the network.
- Created the directory (/var/log/network) to log into.
This is where I diverge slightly from the instructions as with many things in /etc on OSX, if it also has a sub folder structure you're better off adding your conf in there and leaving the main one alone. So,
- Added an ASL conf. This is where I think the problem lies.
/etc/asl/asus-router
# Asus router logs
? [A= Host router.asus.com] store_directory /var/log/network uid=0 gid=20 mode=0644 format=bsd rotate=seq compress file_max=5M all_max=50M
# I've also tried:
#? [= Host 192.168.1.1] …
#? [A= Host 192.168.1.1] …
#? [= Host router.asus.com] …
#? [= Sender router.asus.com] …
#? [A= Sender router.asus.com] …
#? [= IP router.asus.com] …
#? [A= IP router.asus.com] …
- Unloaded and loaded the syslog plist to pick up the new conf.
- Logged in to the router via SSH. This helpfully adds a log entry and I got the following info:
ssh'd into the router
nvram show | grep log_level
size: 50509 bytes (15027 left)
log_level=6
ps | grep syslog
9358 iain 1488 S /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 6 -R 192.168.1.140:514 -L
Finally, I turned off the firewall and ran sudo tcpdump udp port 514. I can see logs coming in but nothing shows up in the Console even if I reload the plist.
06:21:38.983497 IP router.asus.com.40420 > iains-air.syslog: SYSLOG authpriv.info, length: 86
I've even taken a look at RFC5424 to see if I could glean how I might match on the hostname, but as ever with RFC's, they're pretty abstract. The only thing I can think to do is edit /etc/syslog.conf, but I wouldn't know with what.
Any suggestions or insights would be gratefully accepted.
macos router logging syslog asl
asked Mar 26 '17 at 5:54
IainIain
136312
|
show 1 more comment
I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as a syslog server but the Console shows nothing under /var/log/network (though the directory does show).
The steps I've taken:
- Set the IP of my laptop in the router's admin page for syslogging.
- Updated the syslog plist to listen on the network.
- Created the directory (/var/log/network) to log into.
This is where I diverge slightly from the instructions as with many things in /etc on OSX, if it also has a sub folder structure you're better off adding your conf in there and leaving the main one alone. So,
- Added an ASL conf. This is where I think the problem lies.
/etc/asl/asus-router
# Asus router logs
? [A= Host router.asus.com] store_directory /var/log/network uid=0 gid=20 mode=0644 format=bsd rotate=seq compress file_max=5M all_max=50M
# I've also tried:
#? [= Host 192.168.1.1] …
#? [A= Host 192.168.1.1] …
#? [= Host router.asus.com] …
#? [= Sender router.asus.com] …
#? [A= Sender router.asus.com] …
#? [= IP router.asus.com] …
#? [A= IP router.asus.com] …
- Unloaded and loaded the syslog plist to pick up the new conf.
- Logged in to the router via SSH. This helpfully adds a log entry and I got the following info:
ssh'd into the router
nvram show | grep log_level
size: 50509 bytes (15027 left)
log_level=6
ps | grep syslog
9358 iain 1488 S /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 6 -R 192.168.1.140:514 -L
Finally, I turned off the firewall and ran sudo tcpdump udp port 514. I can see logs coming in but nothing shows up in the Console even if I reload the plist.
06:21:38.983497 IP router.asus.com.40420 > iains-air.syslog: SYSLOG authpriv.info, length: 86
I've even taken a look at RFC5424 to see if I could glean how I might match on the hostname, but as ever with RFC's, they're pretty abstract. The only thing I can think to do is edit /etc/syslog.conf, but I wouldn't know with what.
Any suggestions or insights would be gratefully accepted.
macos router logging syslog asl
asked Mar 26 '17 at 5:54
IainIain
136312
1
The router configuration is described here and that of OSX is here. Add info to the post if this does not work.
– harrymc
Mar 29 '17 at 7:20
@harrymc There's nothing to add because the only thing from those I haven't done is to add the line to /etc/syslog.conf, which I did and nothing happened, but the conf has "# Note that flat file logs are now configured in /etc/asl.conf" so it seems that line is unnecessary anyway. I think the problem lies in the asl conf but finding good examples for it is hard.
– Iain
Mar 30 '17 at 17:27
@harrymc That's the one I linked at the top of my question ;-)
– Iain
Mar 30 '17 at 20:57
Oups. Have you traced to see where is the problem? The choice is between the router not sending or OSX ignoring (or both). I would also search for all files withaslin their name.
– harrymc
Mar 31 '17 at 5:10
On the Mac, runsudo lsof -nPi 4 | grep :514to see if anything's actually listening on the syslog port (514/UDP). If not, you might not have successfully edited your syslogd launchctl plist, or you didn't unload and reload it.
– Spiff
Apr 1 '17 at 3:18
|
show 1 more comment
I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as a syslog server but the Console shows nothing under /var/log/network (though the directory does show).
The steps I've taken:
- Set the IP of my laptop in the router's admin page for syslogging.
- Updated the syslog plist to listen on the network.
- Created the directory (/var/log/network) to log into.
This is where I diverge slightly from the instructions as with many things in /etc on OSX, if it also has a sub folder structure you're better off adding your conf in there and leaving the main one alone. So,
- Added an ASL conf. This is where I think the problem lies.
/etc/asl/asus-router
# Asus router logs
? [A= Host router.asus.com] store_directory /var/log/network uid=0 gid=20 mode=0644 format=bsd rotate=seq compress file_max=5M all_max=50M
# I've also tried:
#? [= Host 192.168.1.1] …
#? [A= Host 192.168.1.1] …
#? [= Host router.asus.com] …
#? [= Sender router.asus.com] …
#? [A= Sender router.asus.com] …
#? [= IP router.asus.com] …
#? [A= IP router.asus.com] …
- Unloaded and loaded the syslog plist to pick up the new conf.
- Logged in to the router via SSH. This helpfully adds a log entry and I got the following info:
ssh'd into the router
nvram show | grep log_level
size: 50509 bytes (15027 left)
log_level=6
ps | grep syslog
9358 iain 1488 S /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 6 -R 192.168.1.140:514 -L
Finally, I turned off the firewall and ran sudo tcpdump udp port 514. I can see logs coming in but nothing shows up in the Console even if I reload the plist.
06:21:38.983497 IP router.asus.com.40420 > iains-air.syslog: SYSLOG authpriv.info, length: 86
I've even taken a look at RFC5424 to see if I could glean how I might match on the hostname, but as ever with RFC's, they're pretty abstract. The only thing I can think to do is edit /etc/syslog.conf, but I wouldn't know with what.
Any suggestions or insights would be gratefully accepted.
macos router logging syslog asl
asked Mar 26 '17 at 5:54
IainIain
136312
I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as a syslog server but the Console shows nothing under /var/log/network (though the directory does show).
The steps I've taken:
- Set the IP of my laptop in the router's admin page for syslogging.
- Updated the syslog plist to listen on the network.
- Created the directory (/var/log/network) to log into.
This is where I diverge slightly from the instructions as with many things in /etc on OSX, if it also has a sub folder structure you're better off adding your conf in there and leaving the main one alone. So,
- Added an ASL conf. This is where I think the problem lies.
/etc/asl/asus-router
# Asus router logs
? [A= Host router.asus.com] store_directory /var/log/network uid=0 gid=20 mode=0644 format=bsd rotate=seq compress file_max=5M all_max=50M
# I've also tried:
#? [= Host 192.168.1.1] …
#? [A= Host 192.168.1.1] …
#? [= Host router.asus.com] …
#? [= Sender router.asus.com] …
#? [A= Sender router.asus.com] …
#? [= IP router.asus.com] …
#? [A= IP router.asus.com] …
- Unloaded and loaded the syslog plist to pick up the new conf.
- Logged in to the router via SSH. This helpfully adds a log entry and I got the following info:
ssh'd into the router
nvram show | grep log_level
size: 50509 bytes (15027 left)
log_level=6
ps | grep syslog
9358 iain 1488 S /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 6 -R 192.168.1.140:514 -L
Finally, I turned off the firewall and ran sudo tcpdump udp port 514. I can see logs coming in but nothing shows up in the Console even if I reload the plist.
06:21:38.983497 IP router.asus.com.40420 > iains-air.syslog: SYSLOG authpriv.info, length: 86
I've even taken a look at RFC5424 to see if I could glean how I might match on the hostname, but as ever with RFC's, they're pretty abstract. The only thing I can think to do is edit /etc/syslog.conf, but I wouldn't know with what.
Any suggestions or insights would be gratefully accepted.
macos router logging syslog asl
macos router logging syslog asl
asked Mar 26 '17 at 5:54
IainIain
136312
asked Mar 26 '17 at 5:54
IainIain
136312
asked Mar 26 '17 at 5:54
IainIain
136312
asked Mar 26 '17 at 5:54
IainIain
136312
asked Mar 26 '17 at 5:54
IainIain
136312
136312
1
The router configuration is described here and that of OSX is here. Add info to the post if this does not work.
– harrymc
Mar 29 '17 at 7:20
@harrymc There's nothing to add because the only thing from those I haven't done is to add the line to /etc/syslog.conf, which I did and nothing happened, but the conf has "# Note that flat file logs are now configured in /etc/asl.conf" so it seems that line is unnecessary anyway. I think the problem lies in the asl conf but finding good examples for it is hard.
– Iain
Mar 30 '17 at 17:27
@harrymc That's the one I linked at the top of my question ;-)
– Iain
Mar 30 '17 at 20:57
Oups. Have you traced to see where is the problem? The choice is between the router not sending or OSX ignoring (or both). I would also search for all files withaslin their name.
– harrymc
Mar 31 '17 at 5:10
On the Mac, runsudo lsof -nPi 4 | grep :514to see if anything's actually listening on the syslog port (514/UDP). If not, you might not have successfully edited your syslogd launchctl plist, or you didn't unload and reload it.
– Spiff
Apr 1 '17 at 3:18
|
show 1 more comment
1
The router configuration is described here and that of OSX is here. Add info to the post if this does not work.
– harrymc
Mar 29 '17 at 7:20
@harrymc There's nothing to add because the only thing from those I haven't done is to add the line to /etc/syslog.conf, which I did and nothing happened, but the conf has "# Note that flat file logs are now configured in /etc/asl.conf" so it seems that line is unnecessary anyway. I think the problem lies in the asl conf but finding good examples for it is hard.
– Iain
Mar 30 '17 at 17:27
@harrymc That's the one I linked at the top of my question ;-)
– Iain
Mar 30 '17 at 20:57
Oups. Have you traced to see where is the problem? The choice is between the router not sending or OSX ignoring (or both). I would also search for all files withaslin their name.
– harrymc
Mar 31 '17 at 5:10
On the Mac, runsudo lsof -nPi 4 | grep :514to see if anything's actually listening on the syslog port (514/UDP). If not, you might not have successfully edited your syslogd launchctl plist, or you didn't unload and reload it.
– Spiff
Apr 1 '17 at 3:18
1
1
The router configuration is described here and that of OSX is here. Add info to the post if this does not work.
– harrymc
Mar 29 '17 at 7:20
The router configuration is described here and that of OSX is here. Add info to the post if this does not work.
– harrymc
Mar 29 '17 at 7:20
@harrymc There's nothing to add because the only thing from those I haven't done is to add the line to /etc/syslog.conf, which I did and nothing happened, but the conf has "# Note that flat file logs are now configured in /etc/asl.conf" so it seems that line is unnecessary anyway. I think the problem lies in the asl conf but finding good examples for it is hard.
– Iain
Mar 30 '17 at 17:27
@harrymc There's nothing to add because the only thing from those I haven't done is to add the line to /etc/syslog.conf, which I did and nothing happened, but the conf has "# Note that flat file logs are now configured in /etc/asl.conf" so it seems that line is unnecessary anyway. I think the problem lies in the asl conf but finding good examples for it is hard.
– Iain
Mar 30 '17 at 17:27
@harrymc That's the one I linked at the top of my question ;-)
– Iain
Mar 30 '17 at 20:57
@harrymc That's the one I linked at the top of my question ;-)
– Iain
Mar 30 '17 at 20:57
Oups. Have you traced to see where is the problem? The choice is between the router not sending or OSX ignoring (or both). I would also search for all files with
asl in their name.– harrymc
Mar 31 '17 at 5:10
Oups. Have you traced to see where is the problem? The choice is between the router not sending or OSX ignoring (or both). I would also search for all files with
asl in their name.– harrymc
Mar 31 '17 at 5:10
On the Mac, run
sudo lsof -nPi 4 | grep :514 to see if anything's actually listening on the syslog port (514/UDP). If not, you might not have successfully edited your syslogd launchctl plist, or you didn't unload and reload it.– Spiff
Apr 1 '17 at 3:18
On the Mac, run
sudo lsof -nPi 4 | grep :514 to see if anything's actually listening on the syslog port (514/UDP). If not, you might not have successfully edited your syslogd launchctl plist, or you didn't unload and reload it.– Spiff
Apr 1 '17 at 3:18
|
show 1 more comment
1 Answer
1
active
oldest
votes
I had the same issue, needed a syslog server running on my OSX platform to capture syslog events from my network devices. I solved this issue by downloading and installing the following application "Lan-Secure Mac Syslog Server" that can be found on the following link: http://www.lan-secure.com/SyslogServerMac.htm
Once I installed the software that was very simple as just running the installer, my OSX platform starts collecting syslog events and display them on the software console. I also enabled the email notifications feature so I'll be able to be informed immediately about critical events.
answered Jan 25 at 8:03
Mary.SMary.S
112
Thanks Mary.S, I'll give that a look.
– Iain
Jan 25 at 9:27
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1192453%2frunning-osx-as-a-syslog-server%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I had the same issue, needed a syslog server running on my OSX platform to capture syslog events from my network devices. I solved this issue by downloading and installing the following application "Lan-Secure Mac Syslog Server" that can be found on the following link: http://www.lan-secure.com/SyslogServerMac.htm
Once I installed the software that was very simple as just running the installer, my OSX platform starts collecting syslog events and display them on the software console. I also enabled the email notifications feature so I'll be able to be informed immediately about critical events.
answered Jan 25 at 8:03
Mary.SMary.S
112
Thanks Mary.S, I'll give that a look.
– Iain
Jan 25 at 9:27
add a comment |
I had the same issue, needed a syslog server running on my OSX platform to capture syslog events from my network devices. I solved this issue by downloading and installing the following application "Lan-Secure Mac Syslog Server" that can be found on the following link: http://www.lan-secure.com/SyslogServerMac.htm
Once I installed the software that was very simple as just running the installer, my OSX platform starts collecting syslog events and display them on the software console. I also enabled the email notifications feature so I'll be able to be informed immediately about critical events.
answered Jan 25 at 8:03
Mary.SMary.S
112
Thanks Mary.S, I'll give that a look.
– Iain
Jan 25 at 9:27
add a comment |
I had the same issue, needed a syslog server running on my OSX platform to capture syslog events from my network devices. I solved this issue by downloading and installing the following application "Lan-Secure Mac Syslog Server" that can be found on the following link: http://www.lan-secure.com/SyslogServerMac.htm
Once I installed the software that was very simple as just running the installer, my OSX platform starts collecting syslog events and display them on the software console. I also enabled the email notifications feature so I'll be able to be informed immediately about critical events.
answered Jan 25 at 8:03
Mary.SMary.S
112
I had the same issue, needed a syslog server running on my OSX platform to capture syslog events from my network devices. I solved this issue by downloading and installing the following application "Lan-Secure Mac Syslog Server" that can be found on the following link: http://www.lan-secure.com/SyslogServerMac.htm
Once I installed the software that was very simple as just running the installer, my OSX platform starts collecting syslog events and display them on the software console. I also enabled the email notifications feature so I'll be able to be informed immediately about critical events.
answered Jan 25 at 8:03
Mary.SMary.S
112
answered Jan 25 at 8:03
Mary.SMary.S
112
answered Jan 25 at 8:03
Mary.SMary.S
112
answered Jan 25 at 8:03
Mary.SMary.S
112
112
Thanks Mary.S, I'll give that a look.
– Iain
Jan 25 at 9:27
add a comment |
Thanks Mary.S, I'll give that a look.
– Iain
Jan 25 at 9:27
Thanks Mary.S, I'll give that a look.
– Iain
Jan 25 at 9:27
Thanks Mary.S, I'll give that a look.
– Iain
Jan 25 at 9:27
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1192453%2frunning-osx-as-a-syslog-server%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
The router configuration is described here and that of OSX is here. Add info to the post if this does not work.
– harrymc
Mar 29 '17 at 7:20
@harrymc There's nothing to add because the only thing from those I haven't done is to add the line to /etc/syslog.conf, which I did and nothing happened, but the conf has "# Note that flat file logs are now configured in /etc/asl.conf" so it seems that line is unnecessary anyway. I think the problem lies in the asl conf but finding good examples for it is hard.
– Iain
Mar 30 '17 at 17:27
@harrymc That's the one I linked at the top of my question ;-)
– Iain
Mar 30 '17 at 20:57
Oups. Have you traced to see where is the problem? The choice is between the router not sending or OSX ignoring (or both). I would also search for all files with
aslin their name.– harrymc
Mar 31 '17 at 5:10
On the Mac, run
sudo lsof -nPi 4 | grep :514to see if anything's actually listening on the syslog port (514/UDP). If not, you might not have successfully edited your syslogd launchctl plist, or you didn't unload and reload it.– Spiff
Apr 1 '17 at 3:18