Koozali.org: home of the SME Server

Obsolete Releases => SME Server 8.x => Topic started by: bloxguy on May 15, 2014, 12:24:28 AM

Title: Exporting SYSLOG(s) to Remote Server?
Post by: bloxguy on May 15, 2014, 12:24:28 AM

Is there anyway to export the syslogs from /var/logs/messages to an external SYSLOG server, ie: SPLUNK?
if so, how can I set this up?

Is there a chance this feature could also be added to the general configuration of the server?
it would be great to be able to monitor SME servers using SPLUNK.

Title: Re: Exporting SYSLOG(s) to Remote Server?
Post by: CharlieBrady on May 15, 2014, 03:01:38 AM

Quote from: bloxguy on May 15, 2014, 12:24:28 AM

Is there anyway to export the syslogs from /var/logs/messages to an external SYSLOG server, ie: SPLUNK?
if so, how can I set this up?

You need to do some reading of the documentation here. Search for "custom templates".

Quote

Is there a chance this feature could also be added to the general configuration of the server?

Again, please read some of the documentation here. You can ask for New Feature Requests via the bug tracker. But you need to be aware that there are many more feature requests than there are developers to implement them. If you want something, do it yourself, and then contribute it.

Title: Re: Exporting SYSLOG(s) to Remote Server?
Post by: Stefano on May 15, 2014, 10:13:57 AM

Quote from: CharlieBrady on May 15, 2014, 03:01:38 AM

You need to do some reading of the documentation here. Search for "custom templates".

or just search the wiki:

http://wiki.contribs.org/Syslog

Title: Re: Exporting SYSLOG(s) to Remote Server?
Post by: CharlieBrady on May 15, 2014, 03:04:41 PM

Quote from: Stefano on May 15, 2014, 10:13:57 AM

or just search the wiki:

http://wiki.contribs.org/Syslog

Those deal with information flow in the other direction, i.e.. into SME server. OP wants syslog messages to flow out from SME server to another system.

OP needs "*.*   @a.b.c.d" entries in syslog.conf, via a custom template.

Title: Re: Exporting SYSLOG(s) to Remote Server?
Post by: Stefano on May 15, 2014, 03:10:50 PM

doh, you're right.. :-)

I really need more coffee in the morning.. ;-)

Title: Re: Exporting SYSLOG(s) to Remote Server?
Post by: bloxguy on May 15, 2014, 04:45:14 PM

Thanks for the heads up, I'd already read all the documentation/wiki, which lead me to this forum.
Everything posted for SME with regards to SYSLOG is for setting up SME as a recipient server not a forwarder.

Instead of custom scripts, etc, I found that SPLUNK has created a "universal forwarder" RPM package that can be adapted to run on SME.
If there is somewhere on the site to post a HOWTO; I would be glad to share the information.
I currently have SME 8.x reporting to SPLUNK 6.1.x with no issues.

but again, as a "nice to have" it would be great to see this built into the product; and made configurable through the GUI.

Title: Re: Exporting SYSLOG(s) to Remote Server?
Post by: ReetP on May 19, 2014, 04:51:27 PM

Quote from: bloxguy on May 15, 2014, 04:45:14 PM

If there is somewhere on the site to post a HOWTO; I would be glad to share the information.

The Wiki is the place. You can get an account easily here :

http://wiki.contribs.org/Help:Contents

Quote

but again, as a "nice to have" it would be great to see this built into the product; and made configurable through the GUI.

Lots of things we'd all like to have but it is time and resources :-) We have very little of either.

If you want to look at building this as a contrib then go to the bug tracker and you will get help.

Make sure you are on the mailing lists too :

http://lists.contribs.org/mailman/listinfo/

Please get involved - you have done half the work already !!

B. Rgds
John Crisp