Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am trying to configure rsyslog (Ubuntu 12.04 Server) to log events from a router. I found this old ubuntu forum post which got me most of the way there.

So far I am able to get the events logged from the router. However since I don't them logged in /var/log/syslog I am trying to set up a working filter in /etc/rsyslog.conf to put the logged events in /var/log/linksys.log. This is where I am having trouble.

  • First I tried filtering by the router ip address like this:

    :fromhost-ip, isequal, "192.168.2.1" /var/log/linksys.log
    & ~
    

    This successfully redirects the logs as I wanted, the only problem is now I am not getting any SSHD logs in auth.log. Needless to say this is not acceptable.

  • Next I tried filtering by the router name which appears in every event log:

    :msg,contains, "RV042" /var/log/linksys.log
    & ~
    

    Although this neither logs or blocks anything.

So I am stumped. I have no idea why SSHD is getting filtered with the :fromhost-ip filter. SSHD is local on the machine with rsyslog (192.168.2.2). I am thoroughly frustrated by this, any suggestions are much appreciated.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

I figured it out! These links helped:

http://www.rsyslog.com/tag/udp/

http://www.rsyslog.com/doc/multi_ruleset.html

Here's what I did:

Opened up /etc/rsyslog.d/50-default.conf and at the top of the file, before other all of the default filters, I added:

# process remote messages
# define new ruleset and add rules to it:
$RuleSet remote
*.*           /var/log/linksys.log
# only messages not from 192.168.2.1 make it past this point

# bind ruleset to UDP listener
$InputUDPServerBindRuleset remote
# and activate it:
$UDPServerRun 514

# switch back to the default ruleset:
$RuleSet RSYSLOG_DefaultRuleset
share|improve this answer
add comment

It didn't work for me.I have a Netgear DGND3700 and I enabled the feature to send syslogs on my LAN address which is my computer.I have also set up the computer and the modem/router to receive this only one specific address when I am connected to my home network.The address is 192.168.0.5.I did what you describe above and it didn't work for me.I change the parameters such as the name of the log file(mines is netgear.log) and the address from 192.168.2.1 to 192.168.0.5 although I do not think that this would even matter because this line

# only messages not from 192.168.2.1 make it past this point

is a comment.

Do you know how can I fix this?

By the way here is what I added to /etc/rsynlog.conf :

# Router logging
:fromhost-ip, isequal, "192.168.0.1" /var/log/netgear.log
& ~

And above the Default Rules I added :

#process remote messages
 #define new ruleset and add rules to it:
 $RuleSet remote
*.*           /var/log/netgear.log
 #only messages not from 192.168.0.1 make it past this point

 #bind ruleset to UDP listener
 $InputUDPServerBindRuleset remote
 #and activate it:
 $UDPServerRun 514

 #switch back to the default ruleset:
 $RuleSet RSYSLOG_DefaultRuleset
share|improve this answer
    
Do you have these lines uncommented in the modules section '$ModLoad imudp' and '$UDPServerRun 514' ..(assuming your router also uses this)? Also I believe I only ended up adding the "Default Rules" part. –  jpetersen Sep 5 '12 at 16:22
    
Yes they are uncommented.How do I find out what my modem/router uses? –  underdog012 Sep 5 '12 at 18:59
    
I can't find if my router uses these things that you mention.Do you know how can I found out what my router uses? –  underdog012 Sep 6 '12 at 17:36
    
Sorry but I don't, although I think UDP port 514 is pretty standard. You might want to ask a new question and include some more details. Include what part isn't working.... are you getting any logs from your router or just not in netgear.log? First try to get logs to appear in syslog and don't worry about the filtering rules for now. If your not getting anything in your syslog file then check that your firewall isn't blocking the traffic. Also check that the logs are being sent, you can look at network traffic with iptraf. Good luck, it took me a while to figure mine out. –  jpetersen Sep 6 '12 at 19:36
    
Thanks for your answer.I will try to find out what is going on.iptraf is a great program by the way.Thanks. –  underdog012 Sep 6 '12 at 19:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.