NSO not sending log messages to the syslog server

[bashar1aziz@gmail.com]

Dear All,

Refering to NSO Administration guide Syslog, NSO is configured as follow:

<logs>
<syslog-config>
<facility>daemon</facility>
<syslog-servers>
<server>
<host>10.1.1.80</host>
<port>514</port>
</server>
</syslog-servers>
</syslog-config>

<ncs-log>
<enabled>true</enabled>
<file>
<name>${NCS_LOG_DIR}/ncs.log</name>
<enabled>true</enabled>
</file>
<syslog>
<enabled>true</enabled>
</syslog>
</ncs-log>

<developer-log>
<enabled>true</enabled>
<file>
<name>${NCS_LOG_DIR}/devel.log</name>
<enabled>true</enabled>
</file>
</developer-log>
<developer-log-level>info</developer-log-level>

<audit-log>
<enabled>true</enabled>
<file>
<name>${NCS_LOG_DIR}/audit.log</name>
<enabled>true</enabled>
</file>
</audit-log>

<netconf-log>
<enabled>true</enabled>
<file>
<name>${NCS_LOG_DIR}/netconf.log</name>
<enabled>true</enabled>
</file>
</netconf-log>

<snmp-log>
<enabled>true</enabled>
<file>
<name>${NCS_LOG_DIR}/snmp.log</name>
<enabled>true</enabled>
</file>
</snmp-log>

<webui-access-log>
<enabled>true</enabled>
<dir>${NCS_LOG_DIR}</dir>
</webui-access-log>

<!-- This log is disabled by default if ncs is installed using -->
<!-- the 'system-install' flag. It consumes a lot of CPU power -->
<!-- to have this log turned on, OTOH it is the best tool to -->
<!-- debug must expressions in YANG models -->

<xpath-trace-log>
<enabled>false</enabled>
<filename>${NCS_LOG_DIR}/xpath.trace</filename>
</xpath-trace-log>

<error-log>
<enabled>true</enabled>
<filename>${NCS_LOG_DIR}/ncserr.log</filename>
</error-log>

<progress-trace>
<enabled>true</enabled>
<dir>${NCS_LOG_DIR}</dir>
</progress-trace>
</logs>

tcpdump and remote syslog there no actitivty, am I missing some config ?

Regards,

Bashar Aziz

[Alexander Stevenson]

Hello Bashar,

I did some looking around and found a GitHub repo for setting up an NSO and Syslog Daemon relay

Their file ncs.conf is very similar to what you have here but with some key differences. It might be worth your time to read through this file, as well as their README

Other resources/notes/links:

- NSO supports generating BSD and RFC 5424 syslog messages.

- Syslog in NSO / Monitoring NSO

- Sending NSO logs to stdout

- NSO Troubleshooting

- Configuring a Cisco Device to send Syslog Messages

Hope this helps,

                        Alex Stevenson

[gmuloche]

Hello,

I am not sure which NSO version you are using and hence which NSO guide you are reading but be aware of the following changes:

if you look into the CHANGES file of NSO 5.x you should see for NSO 5.1:

- ncs: Support for syslog via UDP has been removed in order to comply with
Cisco security requirements. The default syslog functionality via libc
syslog(3) is still available.

(ENG-16844)

and later on (NSO 5.3):

- documentation: Updated documentation to remove mentions of syslog via
UDP functionality removed by ENG-16844.

(ENG-22252, RT:39153, PS-34226, CSCvr88985, SR:687451647)

which could explain why you don't see anything despite being able to configure it (in the YANG model the leaves are present as obsolete which explains why you still manage to configure them in ncs.conf)

The current recommendation is indeed as @Alexander Stevenson mentioned to use some relay to forward the logs.