Details

    • Help
    • Resolution: Done
    • Major
    • None
    • Professional Edition
    • Default
    • None
    • Ubuntu 20.04

    Description

      Hello,

      I tried to run syslog, according to the documentation ( https://docs.observium.org/syslog/#rsyslogd ), but I am still facing the problem "No syslog entries found".

      It doesn't look like a firewall problem. As you can see in the screenshot tcpdump receives messages. Besides, the server as well as the device is on the same subnet.

       

      Here is the configuration:

      30-observium.conf

      #---------------------------------------------------------
      # send remote logs to observium# provides UDP syslog reception
      module(load="imudp")input(type="imudp"
        port="514"
        ruleset="observium")## provides TCP syslog reception (uncomment if required)
      #module(load="imptcp")
      #
      #input(type="imptcp"
      #      port="514"
      #      ruleset="observium")module(load="omprog")
      # observium syslog template
      template(name="observium"
           type="string"
           string="%fromhost-ip%||%syslogfacility%||%syslogpriority%||%syslogseverity%||%syslogtag%||%$year%-%$month%-%$day% %timereported:8:25%||%msg:::space-cc%||%programname%\n")
      # observium RuleSets
      #ruleset(name="observium") {
      #   action(type="omprog"
      #          binary="/opt/observium/syslog.php"
      #          template="observium")
      #   stop
      #}
      ruleset(name="observium") {
          if $syslogseverity <= '5' then action(type="omprog" binary="/opt/observium/syslog.php" template="observium")
          stop
      }
      #--------------------------------------------------------- 

      yslog.conf

       

      # /etc/rsyslog.conf configuration file for rsyslog
      #
      # For more information install rsyslog-doc and see
      # /usr/share/doc/rsyslog-doc/html/configuration/index.html
      #
      # Default logging rules can be found in /etc/rsyslog.d/50-default.conf
      #################
      #### MODULES ####
      #################module(load="imuxsock") # provides support for local system logging
      #module(load="immark")  # provides --MARK-- message capability# provides UDP syslog reception
      #module(load="imudp")
      #input(type="imudp" port="514")# provides TCP syslog reception
      #module(load="imtcp")
      #input(type="imtcp" port="514")
      # provides kernel logging support and enable non-kernel klog messages
      module(load="imklog" permitnonkernelfacility="on")
      ###########################
      #### GLOBAL DIRECTIVES ####
      ############################
      # Use traditional timestamp format.
      # To enable high precision timestamps, comment out the following line.
      #
      $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
      # Filter duplicated messages
      $RepeatedMsgReduction on
      #
      # Set the default permissions for all log files.
      #
      $FileOwner syslog
      $FileGroup adm
      $FileCreateMode 0640
      $DirCreateMode 0755
      $Umask 0022
      $PrivDropToUser syslog
      $PrivDropToGroup syslog
      $ModLoad imudp
      $UDPServerRun 514
      #
      # Where to place spool and state files
      #
      $WorkDirectory /var/spool/rsyslog
      #
      # Include all config files in /etc/rsyslog.d/ 

      If you need more informations, let me know.

       

      I'd really appreciate your help

      Attachments

        1. tcpdump_syslog.png
          tcpdump_syslog.png
          29 kB
        2. rsyslog_status.png
          rsyslog_status.png
          52 kB
        3. observiu_syslog_settings.png
          observiu_syslog_settings.png
          134 kB

        Activity

          [OBS-4449] No syslog entries found

          I have discovered IP address and I have enable feature "Associate hosts by Cached IP". It still doesn't work. Any ideas?

           

          helpdeskclip Helpdesk added a comment - I have discovered IP address and I have enable feature "Associate hosts by Cached IP". It still doesn't work. Any ideas?  
          landy Mike Stupalov made changes -
          Resolution New: Done [ 10000 ]
          Status Original: Pending Response [ 10000 ] New: Resolved [ 5 ]

          While you use IP %fromhost-ip% for hosts association, your devices must have discovered IP addresses. Check device page -> Ports tab (there should be IPv4/IPv6 links). Check that there are correct IP addresses.

          If devices not have discovered IP addresses, try "Mapping unknown hosts":
          https://docs.observium.org/syslog/#match-syslog-hostnameip-with-device

          Additionally, latest revisions support associate hosts by cached IP addresses (dns resolved ip), but you should enable this feature in Global Settings: Syslog -> Associate hosts by Cached IP

          landy Mike Stupalov added a comment - While you use IP %fromhost-ip% for hosts association, your devices must have discovered IP addresses. Check device page -> Ports tab (there should be IPv4/IPv6 links). Check that there are correct IP addresses. If devices not have discovered IP addresses, try "Mapping unknown hosts": https://docs.observium.org/syslog/#match-syslog-hostnameip-with-device Additionally, latest revisions support associate hosts by cached IP addresses (dns resolved ip), but you should enable this feature in Global Settings: Syslog -> Associate hosts by Cached IP
          bot Observium Bot made changes -
          Component/s New: Default [ 10900 ]
          bot Observium Bot made changes -
          Assignee Original: Adam Armstrong [ adama ] New: Mike Stupalov [ landy ]
          bot Observium Bot made changes -
          Status Original: Open [ 1 ] New: Pending Response [ 10000 ]
          helpdeskclip Helpdesk created issue -

          General questions and device support can be discussed in our Discord channel, click here to join.


          Please make and attach additional information about the device:

          • full snmp dump from device:

            snmpwalk -v2c -c <community> -t 3 -Cc --hexOutputLength=0 -ObentxU <hostname> .1 > myagent.snmpwalk
            snmpwalk -v2c -c <community> -t 3 -Cc --hexOutputLength=0 -ObentxU <hostname> .1.3.6.1.4.1 >> myagent.snmpwalk

            If device not support SNMP version 2c, replace -v2c with -v1.

          • If you have problems with discovery or poller processes, please do and attach these debugs:

            ./discovery.php -d -h <device>
            ./poller.php -d -h <device>

          • additionally attach device and/or vendor specific MIB files

          This comment is added automatically.

          bot Observium Bot added a comment - General questions and device support can be discussed in our Discord channel, click here to join . Please make and attach additional information about the device: full snmp dump from device: snmpwalk -v2c -c <community> -t 3 -Cc --hexOutputLength=0 -ObentxU <hostname> .1 > myagent.snmpwalk snmpwalk -v2c -c <community> -t 3 -Cc --hexOutputLength=0 -ObentxU <hostname> .1.3.6.1.4.1 >> myagent.snmpwalk If device not support SNMP version 2c, replace -v2c with -v1. If you have problems with discovery or poller processes, please do and attach these debugs: ./discovery.php -d -h <device> ./poller.php -d -h <device> additionally attach device and/or vendor specific MIB files This comment is added automatically.

          People

            landy Mike Stupalov
            helpdeskclip Helpdesk
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: