Remote Log to external server

[demokedes]

Dear all,
I would like to configure my Asuswrt-Merlin to send sys log ro remote server. I configure server address and port. On the other side on the remote server nothing is getting there? What is the frequency of sending messages? In real time or there "per hour" sending? Do I have to somehow force sending? I tried with telnet and remote server is receiving messages, I am sending through telnet.
Thank you in advance!

 

[minimos]

Hi,

It should be in realtime, or at least it is for me when watching the log in the UI and monitoring my remotes yslog, the entries always match.

You mention that you are using telnet to send the message, is that for testing the remote connection, or have you set the port to 23 from the default 514 in the router? It feels like something is not configured right on your syslog server, maybe firewall for the port

 

[demokedes]

Yes, you're right; I am using telnet, just to emulate the send message to remote syslog server.... On Telnet PC client I am using command: telnet ip_address 20514 "test command......where 20514 is port configured on both sides. With this command I mainly ensured network connectivity through firewall. Any idea why my Asus router is not sending log messages? Do I have to configure special outbound rule for port 20514, I don't think so, since usually everything that goes out is allowed or am I mistaken?

 

[minimos]

Yes, you're right; I am using telnet, just to emulate the send message to remote syslog server.... On Telnet PC client I am using command: telnet ip_address 20514 "test command......where 20514 is port configured on both sides. With this command I mainly ensured network connectivity through firewall. Any idea why my Asus router is not sending log messages? Do I have to configure special outbound rule for port 20514, I don't think so, since usually everything that goes out is allowed or am I mistaken?

Hi,

No the routers firewall should not need adjusting.

If you can hit the port from telnet it must mean your syslog host port is open. It sounds like a config on the syslog host. Is the service running, did you change the port in the syslog server to be 20514?

Have you tried sending a test message to the syslog server from one of your computers to test it logs output sent to it? You could try something like an echo message piping its output to the netcat command if you are using Linux.

 

[demokedes]

Minimos,
Yes yes, this is what I am describing: I successfully send a dummy message from my network to syslog server. That means that syslog is configured to accept messages to port 20514. The problem is, that it is not receiving anything from my Asus router.

 

[elorimer]

The server is listening for UDP?

 

[demokedes]

No, it is listening to TCP. Should it be UDP?
Just changed it to the UDP and started working immediately. Thank you elorimer!

 

[elorimer]

Lucky guess. If you need more flexibility, you can install scribe and go the syslog-ng route. Then you can send TCP, if you needed to, or to multiple servers, or only some messages.

 

[Tech9]

Lucky guess.

Really? Syslog server listens on port 514, UDP. Can you guess some LottoMax numbers for me on a private, please?