Librenms Syslog

@librenms.ip rsyslog. @librenms.ip:514 Cisco ASA logging enable logging timestamp logging buffer-size 200000 logging buffered debugging logging trap notifications logging host librenms.ip Cisco IOS logging trap debugging logging facility local6 logging librenms.ip Cisco NXOS logging server librenms.ip 5 use-vrf default facility local6 If you have permitted udp and tcp 514 through any.

Hi, I'm relaying syslog messages like this: device->central-syslog-server -> kubernetes cluster -> librenms-syslog-ng-docker. It works so good but I need to add the keep-hostname(yes).
Syslog/Eventlog Widget Issue. I went from 1.23 to 1.25 and am now having issues with the Syslog and Eventlog dashboard widgets. The syslog entries are larger than the widget so they overlap other widgets. It's consistent across multiple browsers, any idea what I can do to resolve the issue?

We have simple integration for Graylog, you will be able to view anylogs from within LibreNMS that have been parsed by the syslog inputfrom within Graylog itself. This includes logs from devices whicharen't in LibreNMS still, you can also see logs for a specific deviceunder the logs section for the device.

Currently, LibreNMS does not associate shortnames from Graylog withfull FQDNS. If you have your devices in LibreNMS using full FQDNs,such as hostname.example.com, be aware that rsyslogd, by default,sends the shortname only. To fix this, add

$PreserveFQDN on

to your rsyslog config to send the full FQDN so device logs will beassociated correctly in LibreNMS. Also see near the bottom of thisdocument for tips on how to enable/suppress the domain part ofhostnames in syslog-messages for some platforms.

Graylog itself isn't included within LibreNMS, you will need toinstall this separately either on the same infrastructure as LibreNMSor as a totally standalone appliance.

Librenms Syslog Purge

Config is simple, here's an example based on Graylog 2.4:

Timezone

Graylog messages are stored using GMT timezone. You can displaygraylog messages in LibreNMS webui using your desired timezone bysetting the following option in config.php:

Timezone must be PHP supported timezones, available at:https://php.net/manual/en/timezones.php

Graylog Version

If you are running a version earlier than Graylog then please set

to the version number of your Grayloginstall. Earlier versions than 2.1 use the default port 12900

URI

If you have altered the default uri for your Graylog setup then youcan override the default of /api/ using

User Credentials

If you choose to use another user besides the admin user, please notethat currently you must give the user 'admin' permissions from withinGraylog, 'read' permissions alone are not sufficient.

TLS Certificate

If you have enabled TLS for the Graylog API and you are using aself-signed certificate, please make sure that the certificate istrusted by your LibreNMS host, otherwise the connection willfail. Additionally, the certificate's Common Name (CN) has to matchthe FQDN or IP address specified in

Match Any Address

If you want to match the source address of the log entries against anyIP address of a device instead of only against the primary address andthe host name to assign the log entries to a device, you can activatethis function using

Librenms Syslog Server

Recent Devices

There are 2 configuration parameters to influence the behaviour of the'Recent Graylog' table on the overview page of thedevices.

Sets the maximum number of rows to be displayed (default: 10)

You can set which loglevels that should be displayed on the overview page. (default: 7, min:0, max: 7)

Shows only entries with a log level less than or equal to 4 (Emergency,Alert, Critical, Error, Warning).

You can set a default Log Level Filter with

(applies to /graylog and /device/device=/tab=logs/section=graylog/ (min: 0, max: 7)

Domain and hostname handling

Suppressing/enabling the domain part of a hostname for specific platforms

You should see if what you get in syslog/Graylog matches up with yourconfigured hosts first. If you need to modify the syslog messages fromspecific platforms, this may be of assistance: