Unable to add syslog-server on NSO 5.7

manishka · ‎10-04-2022

Hi,

I am new to NSO. I have installed NSO 5.7 on a RHEL VM. I am trying to redirect NSO logs to a remote syslog server with following config in ncs.conf:

<syslog-config>
<facility>daemon</facility>
<syslog-servers>
<server>
<host>10.91.142.104</host>
<port>514</port>
</server>
</syslog-servers>
</syslog-config>

But starting ncs after this change, returns an error:

[nsouser@NSO-dev01-vm 1-simulated-cisco-ios]$ ncs
Bad configuration: /home/nsouser/nso-5.7/examples.ncs/getting-started/using-ncs/1-simulated-cisco-ios/ncs.conf:167: "syslog-servers" is an unknown element.
Daemon died status=21

Am I doing it incorrect ? or NSO 5.7 has removed remote syslog support ?

Regards

Manish

cohult · ‎10-04-2022

From the NSO 5.1 CHANGES:

  - ncs: Support for syslog via UDP has been removed in order to comply with
    Cisco security requirements. The default syslog functionality via libc
    syslog(3) is still available.

    (ENG-16844)

See https://developer.cisco.com/docs/nso/guides/#!nso-5-7-administration-guide-nso-system-management/monitoring-nso under "syslog" for details.

Are you looking for rsyslog? See, for example, https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_basic_system_settings/assembly_troubleshooting-problems-using-log-files_configuring-basic-system-settings#con_services-handling-syslog-messages_assembly_trouble...

cohult · ‎10-05-2022

The https://gitlab.com/nso-developer/ha-hcc/-/tree/main/upgrade-l2 was updated to, among other things, show how an integration with rsyslogd can be done. Some pointers:

manishka · ‎10-06-2022

Thanks Cohult, this helps.

I will setup log fwding via rsyslogd to remote logstash collector.

is Cisco providing NSO log grok patterns ?

if not, I will try to develop it myself.

cohult · ‎10-07-2022

Have not seen any logstash grok patterns/filters for reformatting various NSO log variants. Would be nice to have a repository somewhere for that.