OpenWrt Forum Archive

Topic: How to send log file from router to remote server?

The content of this topic has been archived on 12 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
quocviet1507
18 Jul 2017, 08:05

I want to send syslog to laptop or web logging server (such as loggly.com). I've tried to do this feeding.cloud.geek.nz/posts/debugging-openwrt-routers-by-shipping but it didnt worked

(Last edited by quocviet1507 on 18 Jul 2017, 08:06)

Post #2
augustus_meyer
18 Jul 2017, 08:10

Remote logging is standard feature. Something like this
uci set system.@system[0].log_ip=192.168.254.1

Post #3
quocviet1507
18 Jul 2017, 08:26
augustus_meyer wrote:

Remote logging is standard feature. Something like this
uci set system.@system[0].log_ip=192.168.254.1

My router ip is 192.168.10.1 so i set 

uci set system.@system[0].log_ip=192.168.10.2
uci set system.@system[0].conloglevel=7

And in my linux, I created a 10-router.log file and wrote 

$ModLoad imudp  
$UDPServerRun 514  
:fromhost-ip, isequal, "192.168.10.1" /var/log/router.log  
& ~

Didn't see any router.log in /var/log

Post #4
augustus_meyer
18 Jul 2017, 09:15

I use syslog-ng on linux (ubuntu).
Then I need to configure syslog-ng for remote logs. And configure firewall to allow packets.
Dunno about your linux distro. Check firewall counters on your linux, if packets arrive, at least.

Post #5
quocviet1507
19 Jul 2017, 03:57

I checked the log in router and it said

Wed Jul 19 02:52:59 2017 user.notice root: mylogmessage
Wed Jul 19 02:53:00 2017 daemon.info logread[729]: failed to send log data to 192.168.10.245:514 via udp
Wed Jul 19 02:53:01 2017 daemon.info logread[729]: Logread connected to 192.168.10.245:514

On the server (my laptop - connect with router by ethernet cable and IP is 192.168.10.245), the syslog shown nothing.
I also set up the firewall on linux by allowing udp on port 514 with this command

sudo ufw allow 514/udp

Is there any firewall configuration that I need to notice?

(Last edited by quocviet1507 on 19 Jul 2017, 03:58)

Post #6
quocviet1507
24 Jul 2017, 04:19

It worked. The problem was the linux server. After update rsyslog module it run perfectly

Post #7
nelliot87
30 Jul 2017, 16:51

how that work on windws? how to set

Post #8
golialive
30 Jul 2017, 17:07

Ther's "Kiwi", a syslog server for Windows. Paessler PRTG has a syslog component, too. And if I'm not mistaken, WhatsUp has, too.

The discussion might have continued from here.