Scribe Additional logging to external server

[XIII]

If I use Scribe and the firmware built-in logging to an external server, what will be logged on that external server?

• Everything?
• /tmp/syslog.log entries after Scribe filtering?

In case it's the second, how can I log entries filtered by Scribe as well? (Can I use multiple destinations in Scribe? How to configure an external server destination?)

 

[XIII]

RTFM...

Uncomment/correct (hostname "pi") this in /opt/etc/syslog-ng.conf:

destination log_server { udp("pi" port(514)); };

And use this as additional destination in any desired file in /opt/etc/syslog-ng.d:

destination(log_server);

 

[elorimer]

RTFM...

Uncomment/correct (hostname "pi") this in /opt/etc/syslog-ng.conf:

destination log_server { udp("pi" port(514)); };

And use this as additional destination in any desired file in /opt/etc/syslog-ng.d:

destination(log_server);

Nope, obsolete. Use network() instead.

 

[elorimer]

If I use Scribe and the firmware built-in logging to an external server, what will be logged on that external server?

• Everything?
• /tmp/syslog.log entries after Scribe filtering?

In case it's the second, how can I log entries filtered by Scribe as well? (Can I use multiple destinations in Scribe? How to configure an external server destination?)

Nothing. Scribe will terminate the firmware build-in logging, so that doesn't go anywhere.

Scribe does away with /tmp/syslog.log, so not that either.

You need to define the external server destination within syslog-ng, and then use that destination in your logging statements for syslog-ng to send messages to that destination. You could send everything to the remote destination, which would be like the built in logging, but then not much point.

 

[XIII]

Nope, obsolete. Use network() instead.

So that comment in the file is outdated?

EDIT 1: while it does work with "udp", the documentation indeed mentions "network" so I changed it. Thanks!

EDIT 2: and indeed; I don't forward all logs (I keep the Skynet logs on the router only)

 

[elorimer]

So that comment in the file is outdated?

Yes. There is a Scribe thread here about it. I think it is on the SME's todo list to update to network().

Syslog-ng development is very active, and it isn't so much that deprecated modules are removed (although that seems to happen) and stop working, as work on them stops and proceeds with the new modules. The One Identity OSE documentation is now up to 3.30, while the github stuff is at 3.31.2. Entware is keeping pace. While scribe hasn't updated in almost a year, fortunately, since the great time-reap fiasco there hasn't been a critical problem.