ASUS Router – AC3200 and AC88U are NOT sending sys logs to remote server?

[Vladimir Savekov]

Dear all,

Can you help me out? I am trying to configure remote log server on these two ASUS routers – AC3200 and AC88U but they don’t send logs for some reason and I am not sure what is wrong here.

Conf

Logs

After apply button I can see in the routers log that the system log daemon has been restarted but nothing more, no errors, nothing.

NVRAM

I can also see the entries in the NVRAM which confirms that the values are really there.

---------------------------------------------
#nvram show | egrep "log_ipaddr|log_port"

log_ipaddr= xxx.xxx.xxx.xxx
log_port=6675
---------------------------------------------

But no logs on the remote server. Every other device besides these two routers are sending correct information to the remote sys log server.

Thanks a lot for the help.

Versions of the routers are:

AC3200 - 384.6 – latest Merlin FW.
AC88U - 384.8_2 – latest Merlin FW

Thanks
Vlad

 

[Maverickcdn]

Does your Syslog server require authorizing clients? ie. allowed IPs ? or any filtering in place?

Could try changing default log level to 'all' as well

 

[Vladimir Savekov]

Does your Syslog server require authorizing clients? ie. allowed IPs ? or any filtering in place?

Could try changing default log level to 'all' as well

No, there is no authentication. I will try changing to "all" and report back.

Thanks

 

[Vladimir Savekov]

No, there is no authentication. I will try changing to "all" and report back.

Thanks

Hi there, unfortunately it didnt work... still nothing. No matter what settings I change on these two servers they just dont want to send the logs to the remote log server. This is very strange.

Do you know how can I delete the sys log on the asus router? Clearly the "Clear button" doesnt clear the file it self , I am actually not sure what it clears by clicking "clear" because after a refresh I still see the logs. Maybe I can drop the current systelog files and recreate them , maybe they hang somehow ? I dont know , very odd...

 

[Maverickcdn]

Two guesses.

1 because it's a non standard port maybe it's broken?? Maybe try 514

2 (my more likely guess) you may have to put a usb stick or jffs and set up saving the logs there in the webgui, system might not forward logs if its only saved to ram storage. Someone more familiar with how Asus handles the syslogs can maybe chime in on this one.

 

[Maverickcdn]

Just to be sure, you're not running Skynet/Diversion etc... on there blocking the output??