Re: [gentoo-user] Re: Receiving syslog entries over network with systemd

[Alan McKinnon]

On 06/05/2017 19:41, Mick wrote:
> On Thursday 04 May 2017 15:35:58 Mick wrote:
>> Hi All,
>>
>> I hope this post is not completely off topic.  I have a small LAN server
>> (with Kodi) running systemd and I want to use it to receive and store
>> syslog entries from other devices over the LAN.  I want to keep this system
>> as lightweight as possible, due to its constrained hardware.  What is the
>> best way to go about it and how should I configure systemd?  Please be
>> detailed with your explanations on systemd - my knowledge on this init
>> system and its manifold applications is quite limited.
>
> It was straight forward.  Install syslog-ng, add a configuration to accept
> logs over UDP and install logrotate, which brought in cron and configured the
> required cron job.
>
> This is the additional configuration file I had to create:
>
> $ cat /etc/syslog-ng/conf.d/remote.conf
> source net { source net { udp(); };
> destination remote { file("/var/log/remote/${FULLHOST}-log"); };
> log { source(net); destination(remote); };
>
> I also tried this stanza to bind a LAN IP address for the syslog-ng host to
> listen to for connections from the LAN devices, but then syslog-ng failed to
> start:
>
> source net { syslog(ip(192.168.1.25) transport ("udp")); };
>
> Perhaps the ethernet was not up at the time and after a few attempts syslog-ng
> gave up.  I was able to start it manually after boot though.
>

You might need to tweak your startup order in conf.d
a syslogger normally starts very early in the boot process, before even
networking so that it can log network-y errors.

A remote syslogger needs to start after networking.

-- 
Alan McKinnon
alan.mckinnon@×××××.com