Running OSX as a syslog server

Question

I want to receive the logs from my router (an ASUS RT68U) on my laptop (OSX 10.9). It supports syslog and OSX has ASL (a superset of syslog, apparently). I've followed the instructions in OS X Lion as a syslog server but the Console shows nothing under /var/log/network (though the directory does show).

The steps I've taken:

• Set the IP of my laptop in the router's admin page for syslogging.
• Updated the syslog plist to listen on the network.
• Created the directory (/var/log/network) to log into.

This is where I diverge slightly from the instructions as with many things in /etc on OSX, if it also has a sub folder structure you're better off adding your conf in there and leaving the main one alone. So,

• Added an ASL conf. This is where I think the problem lies.

/etc/asl/asus-router

# Asus router logs
? [A= Host router.asus.com] store_directory /var/log/network uid=0 gid=20 mode=0644 format=bsd rotate=seq compress file_max=5M all_max=50M
# I've also tried:
#? [= Host 192.168.1.1] …
#? [A= Host 192.168.1.1] …
#? [= Host router.asus.com] …
#? [= Sender router.asus.com] …
#? [A= Sender router.asus.com] …
#? [= IP router.asus.com] …
#? [A= IP router.asus.com] …

• Unloaded and loaded the syslog plist to pick up the new conf.
• Logged in to the router via SSH. This helpfully adds a log entry and I got the following info:

ssh'd into the router

nvram show | grep log_level
size: 50509 bytes (15027 left)
log_level=6

ps | grep syslog
 9358 iain  1488 S    /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 6 -R 192.168.1.140:514 -L

Finally, I turned off the firewall and ran sudo tcpdump udp port 514. I can see logs coming in but nothing shows up in the Console even if I reload the plist.

06:21:38.983497 IP router.asus.com.40420 > iains-air.syslog: SYSLOG authpriv.info, length: 86 

I've even taken a look at RFC5424 to see if I could glean how I might match on the hostname, but as ever with RFC's, they're pretty abstract. The only thing I can think to do is edit /etc/syslog.conf, but I wouldn't know with what.

Any suggestions or insights would be gratefully accepted.

Solution

I had the same issue, needed a syslog server running on my OSX platform to capture syslog events from my network devices. I solved this issue by downloading and installing the following application "Lan-Secure Mac Syslog Server" that can be found on the following link: http://www.lan-secure.com/SyslogServerMac.htm

Once I installed the software that was very simple as just running the installer, my OSX platform starts collecting syslog events and display them on the software console. I also enabled the email notifications feature so I'll be able to be informed immediately about critical events.

Comments

[harrymc]

The router configuration is described here and that of OSX is here. Add info to the post if this does not work.

[ian]

@harrymc There's nothing to add because the only thing from those I haven't done is to add the line to /etc/syslog.conf, which I did and nothing happened, but the conf has "# Note that flat file logs are now configured in /etc/asl.conf" so it seems that line is unnecessary anyway. I think the problem lies in the asl conf but finding good examples for it is hard.

[ian]

@harrymc That's the one I linked at the top of my question ;-)

[harrymc]

Oups. Have you traced to see where is the problem? The choice is between the router not sending or OSX ignoring (or both). I would also search for all files with asl in their name.

[Spiff]

On the Mac, run sudo lsof -nPi 4 | grep :514 to see if anything's actually listening on the syslog port (514/UDP). If not, you might not have successfully edited your syslogd launchctl plist, or you didn't unload and reload it.

[ian]

@Spiff Thanks. That command shows both launchd and syslogd are listening. I guess that's how it should look as launchd probably sets up and hands off to syslog but maybe launchd should stop being a listener? I checked the plist is valid and unloaded then loaded using launchctl too.