Remote logging

From Wildix

We have to do following:

• to prepare our host for logs, which will receive and store the logs from Wildix gateway

• to adjust asterisk logging configuration as we need to redirect some logs to local syslog daemon

• to make local syslogd send it to remote host`s syslogd

• to write received logs to separate file on host for logs

1. To make syslogd able to send and receive logs to/from the network, we have to run it with '-r' option. So let`s add to /etc/default/syslogd following string:

SYSLOGD="-r"

That will make syslogd start with this option when system boots. You have to add this string on both Wildix gateway and your host for logs. If /etc/default/syslogd doesn`t exist, create it. If in this file the variable SYSLOGD is already in use, of course, you should not purge it – just add '-r' to that string.

2. You have to check the presence of string "syslogd 514/udp" in /etc/services. It must be present (and not commented!) on both Wildix gateway and host for logs.

3. On Wildix gateway add the string like

syslog.local0 => warning,notice,verbose,error,debug

into /etc/asterisk/logger.conf and the string, for example,

local0.* @192.168.0.2

into /etc/syslog.conf. In this example 192.168.0.2 is your host for logs. It`s much better if lhost for logs is situated near to Wildix gateway to avoid loss of logs data (because syslogd use udp). It`s better to write ip or hostname that is present in local /etc/hosts to avoid DNS requests. If local0 stream is already in use on host for logs or Wildix gateway, you are free to use streams with numbers from 1 to 7 (local1, ..., local7).

4. On host for logs add the string like

local0.* /var/log/asterisk-log

into /etc/syslog.conf. The logs from asterisk will go to file /var/log/asterisk-log now.

5. Reboot loghost and Wildix gateway box or manually kill syslogd processes and run 'syslogd -r' (if you usually run syslogd with some other options, put them too). That`s all, logs from asterisk will flow to host for logs.

PS If you want to know more, you should read manpages :)