Syslog - seperate log for router output ?

I've got logging enabled on my Mavericks server and everything is being written to system.log.
I've set my MAC syslog server as the remote log server for my network router and this is working fine, but everything is being written to system.log, Ideally I'd like it to go to /var/log/router.log
I've created the router.log, and set the ownership (root:admin) and permissions (777), but how do I send just the router logs to that log file ?
The logs looks similar to this :
Mon Apr 28 08:48:10 2014: <12>Apr 28 08:48:00 kernel: DROP IN=ppp0 OUT= MAC= SRC=203.58.25.11 DST=80.xxx.xx.xx LEN=131 TOS=0x00 PREC=0xA0 TTL=107 ID=96 PROTO=UDP SPT=29604 DPT=50976 LEN=111
Mon Apr 28 08:48:12 2014: <12>Apr 28 08:48:01 kernel: DROP IN=ppp0 OUT= MAC= SRC=88.195.144.252 DST=80.xxx.xx.xx LEN=52 TOS=0x00 PREC=0xA0 TTL=114 ID=17397 DF PROTO=TCP SPT=63285 DPT=50976 SEQ=294340858 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B40103030201010402)
Mon Apr 28 08:48:12 2014: <12>Apr 28 08:48:01 kernel: DROP IN=ppp0 OUT= MAC= SRC=113.201.73.109 DST=80.xxx.xx.xx LEN=126 TOS=0x00 PREC=0x20 TTL=45 ID=10052 PROTO=UDP SPT=34680 DPT=50976 LEN=106
But there are other entries like:
Mon Apr 28 09:08:48 2014: <30>Apr 28 09:08:37 dnsmasq-dhcp[228]: DHCPDISCOVER(br0) aa:ad:bb:11:cc:dd
Mon Apr 28 08:59:15 2014: <30>Apr 28 08:59:05 pptpd[1773]: CTRL: Starting call (launching pppd, opening GRE)
Mon Apr 28 08:59:15 2014: <30>Apr 28 08:59:05 pptp[1774]: Plugin pptp.so loaded.
The logs don't show the router name or IP Address, so is the syslog intelligent enough to allow me to log from a specific IP Address or is there some other method. ?
I've read I should use asl.conf, but I'm not sure what to configure to make this work correctly.
Any help or advice would be gratefully received :-)
Thanks

Thanks for the link.
I looked at the raw syslog output to find the host and I've added the following to my asl.conf:
? [A= Host kernel:] file /var/log/router.log file_max=5M all_max=50M
? [A= Host kernel:] ignore
? [A= Host pptp] file /var/log/router.log file_max=5M all_max=50M
? [A= Host pptp:] ignore
? [A= Host pptpd] file /var/log/router.log file_max=5M all_max=50M
? [A= Host pptpd:] ignore
restarted com.apple.syslogd.plist and now the logs are going to router.log.
Couple of questions.
The logs are still going to system.log as well, how do I stop that ? I assumed the ignore would do that..
The log shows as :
Apr 29 12:41:12 kernel: Unknown <Warning>: DROP IN=ppp0 OUT= MAC= SRC=110.200.88.19 DST=80.xxx.xxx.xxx LEN=129 TOS=0x00 PREC=0xA0 TTL=40 ID=5080 PROTO=UDP SPT=20884 DPT=50976 LEN=109
Previously there wasn't the <Warning> in the log. Anyway to remove that ?
Thanks

Similar Messages

(261936172) Q general Are there seperate logs for web services?

Q<general> Are there seperate logs for web services?
A<general> It does not appear that there are any separate logs for web services.
There is knex.log file that records the errors that occur during deployment of
your .jws files. There is also the standard server log that provides information
about server status - you can write to this programmatically if you wish. There
is also the access.log file which record all the HTTP requests so this might cover
some of your web service requests that are transmitted over HTTP.

Maybe the user has deniad Access to the Runbook, check in Runbook Designer.
Seidl Michael | http://www.techguy.at |
twitter.com/techguyat | facebook.com/techguyat

Write processing log for custom output type

Hi,
I have defined a new output type at delivery header level . This is processed using a special function and on processing moves stock from unrestricted to a order special stock.
I need to update the "processing log" of the output with the material document number. Can any one please let me know how I can write to this "processing log" of the output?
Thanks in advance.
Regards.
Hari.

Use function NAST_PROTOCOL_UPDATE:
* No orders found
    wa_msgv_1 = nast-objky+0(10).
    CALL FUNCTION 'NAST_PROTOCOL_UPDATE'
      EXPORTING
        msg_arbgb = c_msgtype
        msg_nr    = 30
        msg_ty    = 'S'
        msg_v1    = 'No orders found for delivery'
        msg_v2    = wa_msgv_1
      EXCEPTIONS
        OTHERS    = 1.

Logging for Router 1760

can any1 pls help... i stuck in create logging for my router. i wish to log all the host connected to my router throught SSH. My router only allow ssh or console.

hi
few posts already been here in netpro about ssh ,the H/W platform may vary depending on case to case....
http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=LAN%2C%20Switching%20and%20Routing&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd91fb2/0
http://forum.cisco.com/eforum/servlet/NetProf;jsessionid=jswaxxoax1.SJ3B?page=netprof&forum=Network%20Infrastructure&topic=LAN%2C%20Switching%20and%20Routing&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd91d30
would suggest to give a search over here too which will also yield a lot for u..
regds

Seperate logs for software virtual hosts?

As the subject says, I'm trying to create seperate web logs for software
virtual hosts, under iPlanet Web Server 4.1.
I found a brief mention of using the "host" parameter for <Client> tags
in the docs, but this just seems to write the same data to all logs
regardless of the client tags.
Relevant bits from obj.conf:
Init fn="init-clf" testlog1="/tmp/access_vh1" testlog2="/tmp/access_vh2"
[ other stuff snipped ]
<Client host="firsthosturl*">
AddLog fn="common-log" name="testlog1"
</Client>
<Client host="secondhosturl*">
AddLog fn="common-log" name="testlog2"
</Client>

Tim Lavoie wrote:
I found a brief mention of using the "host" parameter for <Client> tags
in the docs, but this just seems to write the same data to all logs
regardless of the client tags.
Relevant bits from obj.conf:
Init fn="init-clf" testlog1="/tmp/access_vh1" testlog2="/tmp/access_vh2"
[ other stuff snipped ]
<Client host="firsthosturl*">
AddLog fn="common-log" name="testlog1"
</Client>
<Client host="secondhosturl*">
AddLog fn="common-log" name="testlog2"
</Client>I'm not sure you're allowed to define multiple log files in a single
Init line. Try creating a seperate Init line for each log file (don't
forget the format line as well).
Joe McCabe There's a group of people that worship the number zero.
AOLScape These days nothing's sacred.

Error log table and output type

Hi All,
While creating an invoice(while saving billing document) is it poosible to capture the error in a log in table?
And how is this error log table related to the output type?
Thanks

You seem to be confusing saving of the billing document with creation of the output. These are two independent updates (LUWs). A document may be saved without any output.
If there are any errors in the billing document creation, the document just won't be created. Such errors should be captured in the log of the Blling Due list, if it's been run properly.
To update the processing log for the output, use FM NAST_PROTOCOL_UPDATE.

Configuring syslog and generating logs for a particular period.

Hi...
I have configured syslog server and the loggin enabled on ASA device... I want to generate the complete logs for a particular period of time. How can I generate this report.. Please help me

Hello,
I have an idea how it might work, but it is not certainly the best solution so if you will not find any other, this might work for you.
Enable sending logs to syslog server:
logging source-interface loopback
logging
configure EEM script to run "show log" periodicaly:
event manager applet test
event timer watchdog name test_name time 60 ! in seconds -> every minute
action 1.0 cli command "show log"
Best Regards
Please rate all helpful posts and close solved questions

Need help to get processing log for mass invoice output

Hi Experts,
I have one requirement,
My customer will send invoices to their customers in bulk on monthly basis. The customers will receive the invoices through emails, fax or printout. Now the issue is when they send the output to the customers there might be some failures in delivery because of some reason to some customers. I want to capture all the invoices, customers, medium and error text and want to display as a report.
We can see the processing log for a single invoice in VBFA transaction but I want to display one consolidated list where the user can see all the error log records at one place.
I know some tables where we can see some data in NAST, NACH but I would be greatful to you if you provide some more information about this.
Please provide whatever info you have.
Regards,
Dileep.

Hi Study abap,
go through this code and use the HTEXT fm accordingly to ur requirement. This is just a sample kind of thing which will help u to write s-kunnr in htext.
SELECT-OPTIONS: S_MATNR FOR PBIM-MATNR,
S_WERKS FOR PBIM-WERKS.
DATA: BEGIN OF HTEXT.
INCLUDE STRUCTURE THEAD.
DATA: END OF HTEXT.
DATA: BEGIN OF LTEXT OCCURS 50.
INCLUDE STRUCTURE TLINE.
DATA: END OF LTEXT.
DATA: BEGIN OF DTEXT OCCURS 50.
DATA: MATNR LIKE PBIM-MATNR.
INCLUDE STRUCTURE TLINE.
DATA: END OF DTEXT.
DATA: TNAME LIKE THEAD-TDNAME.
SELECT * FROM PBIM WHERE WERKS IN S_WERKS.
MOVE PBIM-BDZEI TO TNAME.
CALL FUNCTION 'READ_TEXT'
EXPORTING
CLIENT = SY-MANDT
ID = 'PB'
LANGUAGE = 'E'
NAME = TNAME
OBJECT = 'PBPT'
ARCHIVE_HANDLE = 0
IMPORTING
HEADER = HTEXT
TABLES
LINES = LTEXT
EXCEPTIONS
ID = 1
LANGUAGE = 2
NAME = 3
NOT_FOUND = 4
OBJECT = 5
REFERENCE_CHECK = 6
WRONG_ACCESS_TO_ARCHIVE = 7
OTHERS = 8.
LOOP AT LTEXT.
IF LTEXT-TDLINE NE ''.
MOVE LTEXT-TDLINE TO DTEXT-TDLINE.
MOVE PBIM-MATNR TO DTEXT-MATNR.
APPEND DTEXT.
ENDIF.
ENDLOOP.
ENDSELECT.
LOOP AT DTEXT.
WRITE:/ DTEXT-MATNR, DTEXT-TDLINE.
ENDLOOP.
Kindly reward fi found helpful.
cheers,
Hema.

No processing log for outbound delivery for output type

Dear Gurus,
I want to see processing log for output type for outbound delivery .
But when i click processing log push button for output type for outbound delivey , one error is comming as 'NO PROCESSING LOG FOR OUTPUT TYPE'.
Could you please let me the reason ?
Edited by: susheelkodam on Sep 9, 2010 10:33 AM

Hi,
What transaction are you running when you press the [Output log] button? If you're in the create transaction, then I think the output log should be available but if you subsequently go in to VL02N and press the Log button, the I don't think the log is available.
Regards, Andy

Getting processing log for our custom output triggering FM?

Hello,
VA02 > Extras>Header>Output>Edit --- Triggering an custom IDOC
Stadnard SAP output programs shows IDOC number on output processing log. But, our custom programs/FMs the one we use to trigger on order IDOC, don't show the processing log. How to get this processing log for custom FMs just like standard SAP?
Thank you

Hello
I am sending my custom IDOC by using FM 'MASTER_IDOC_DISTRIBUTE', if it went well (sending successfully - status is '03') in next step am using PERFORM FILL_NAST_PROTOCOL(ROIKCALE) routine.
But, when i checked the PROCESSING LOG of the associated green latest item in VA02/03>Extras>OP>Header>Edit....am getting a message that "No processing log exists"
How to get/see my IDOC #?
when i saw the F1, it says, "System logging has been de-activated for the selected output type (use settings in Customizing for current application for the selected output type)"
When i checked the settings in NACE (and then clicking lense), they are fine.
Am i seeing correctly to get/know the generated IDOC #?
Thank you

Change log for outputs

Hi,
How to check change logs for output condition records ?
Thanks
Rama

use txn OY18 and insert table name NACH.
Search for tables and execute the same and then use details for further information.

Deletion Log for output types

Hi all,
Where can i find the deletion log for output types
need to know the username and timestamp.

Hi Mayank,
some of the NACE settings are customizing.
If you enabled the customizing change recordings (which should be ALWAYS enabled on dev system's client), you can browse the changes with the Change Log Browser of customizing tables
To enable the client recording, please find
http://help.sap.com/saphelp_erp60_sp/helpdata/en/7e/c81ec852c511d182c50000e829fbfe/content.htm
If recording was not enabled, no change logs are availible.
You may reconstruct "old" values by drilling into (released) TMS customizing transports to see which values where included but that's pretty technical view of data.
Best regards,
Matthias

Logging: GUI for XML output? (Like Chainsaw for Log4j)?

There is a nice GUI tool to view XML formatted output from Log4J log files. Is there some similar tool for Java logging XML formatted output?

Hi,
<?for-each:ROW?>
<?end for-each?><xsl:variable name="cnt" select="count(//row|//ROW)" />
<?for-each:xdoxslt:foreach_number($_XDOCTX,1,15-count(ROW),1)?> <?end if?>
this will create 15 lines irrespective of you have that much rows of data in xml or not
if you want more help , drop me mail @ [email protected]

Configuring cronie for mailing output [solved]

Hi,
I am having a hard time setting up cronie for mailing output. Jump to the last sentence for the actual question.
From man 8 cron, I read that the -m option "allows you to specify a shell command to use for sending Cron mail output instead of using sendmail(8). This command must accept a fully formatted mail message (with headers) on standard input and send it as a mail message to the recipients specified in the mail headers". I do have msmtp installed. I can do this and receive email successfully:
$ msmtp -t << eof
> To: <my address>@gmail.com
>
> test
> eof
Thus I know that msmtp -t is the command I must provide with the -m option.
Then, I followed these instructions and created /etc/systemd/system/cronie.service.d/mailing.conf which contains:
[Service]
ExecStart=
ExecStart=/usr/bin/crond -n -m 'msmtp -t'
Note: the first, empty ExecStart cancels the former one from the original .service file.
After starting cronie.service, this is the result of systemctl status cronie.service:
cronie.service - Periodic Command Scheduler
Loaded: loaded (/usr/lib/systemd/system/cronie.service; enabled)
Drop-In: /etc/systemd/system/cronie.service.d
└─mailing.conf
Active: active (running) since Mon 2013-06-24 22:58:24 EDT; 2s ago
Main PID: 1457 (crond)
CGroup: name=systemd:/system/cronie.service
└─1457 /usr/bin/crond -n -m msmtp -t
Jun 24 22:58:24 electron systemd[1]: Started Periodic Command Scheduler.
Jun 24 22:58:24 electron crond[1457]: (CRON) INFO (Syslog will be used instead of sendmail.)
Jun 24 22:58:24 electron crond[1457]: (CRON) INFO (running with inotify support)
Jun 24 22:58:24 electron crond[1457]: (CRON) INFO (@reboot jobs will be run at computer's startup.)
It seems that systemd drops the single quotes and takes -t as it's own parameter instead of passing it to msmtp. You can also see that crond logged "Syslog will be used instead of sendmail". I can actually see the output of my commands in /var/log/crond.log. How should I quote the space between msmtp and -t in the ExecStart line of my .service file?
Last edited by a_neutrino (2013-06-30 21:54:53)

Hi,
Thanks a lot for your help. The issue is [solved].
dif wrote:You have to create a file /etc/aliases that holds the addresses where e-mail notifications will be sent to when a user's cronjob creates an output.
It seems unnecessary. The MAILTO variable set in the crontab accepts a complete email address.
dif wrote:Contrary to Wiki, there are no commas separating e-mail addresses if there are a few in a line.
The msmtp man page also says to put commas.
dif wrote:
There is a special script distributed with Arch that is able to scan /etc/aliases for a valid domain address and then calls msmtp. Here is its path
/usr/share/doc/msmtp/find_alias/find_alias_for_msmtp.sh
Copy it to /usr/bin/ and create a simlink:
sudo cp /usr/share/doc/msmtp/find_alias/find_alias_for_msmtp.sh /usr/bin/find_alias_for_msmtp.sh
sudo ln -s /usr/bin/find_alias_for_msmtp.sh /usr/bin/sendmail
Why didn't you just :
chmod +x /usr/share/doc/msmtp/find_alias/find_alias_for_msmtp.sh
ln -s /usr/share/doc/msmtp/find_alias/find_alias_for_msmtp.sh /usr/bin/sendmail
Also, I had to modify the find_alias_for_msmtp.sh script a little because cronie calls sendmail without any parameters:
diff --git a/scripts/find_alias/find_alias_for_msmtp.sh b/scripts/find_alias/find_alias_for_msmtp.sh
index fb485dd..346f313 100644
--- a/scripts/find_alias/find_alias_for_msmtp.sh
+++ b/scripts/find_alias/find_alias_for_msmtp.sh
@@ -16,15 +16,18 @@ MSMTP=`which msmtp || echo "/usr/local/bin/msmtp"`
if [ "$1" = '-i' ] ; then
v_recipient=$2 # mailx calls sendmail with -i as the 1st param and the recipient as the second param
-elif [ "$1" = '-t' ] ; then # most other programs call sendmail with a -t option
+elif [ "$1" = '-t' -o $# = 0 ] ; then
+ # Most other programs call sendmail with a -t option.
+ # cronie calls sendmail without parameters and
+ # expects sendmail to find the recipient in the mail headers.
v_to=`echo "$v_msg" | grep -m 1 'To: '`
v_recipient=${v_to:4:50}
else
- v_recipient=$1 # no parameter, sendmail was called with the recipient as parameter
+ v_recipient=$1 # sendmail was called with the recipient as parameter
fi
-if [ $v_recipient != 0 ] ; then
+if [ "$v_recipient" != 0 ] ; then
# trim spaces from recipient email address
v_recipient="${v_recipient// /}"
Or maybe I missed something. I submitted the patch upstream to see if they think it's relevant.
dif wrote:Hope this helps.
Yes, it did! Thank you so much.

No ACL deny logs for Traffic not matched by Static Object NATs and ACL. Need Help.

I start noticing that I do not see any denied traffic coming in on my ACL. To better explain, lets say I have this config.
### Sample Config ###
object network webserver
host 192.168.1.50
nat (dmz, outside) static X.X.X.X service tcp www www
access-list inbound extended permit ip any4 object webserver eq www
If I generate a traffic from the outside let's say a traffic that is trying to access X.X.X.X via TCP Port 8080 which obviously does not have any NAT entry to it going to my DMZ, I don't see the ACL denies it anymore but instead comes back with a Drop Reason: (nat-no-xlate-to-pat-pool) . On the packet trace I got this. (Below) it seems that does not even hit the ACL as there is no xlate found for it, at least to what the drop reason says.
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 Outside
Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate
Before, using a regular Static PAT on ASA Versions 8.2(5) below, I could get the deny logs (ASA-4-106023). Generally, I use these logs, and are quite important for us specially during auditing.
My question is how can I generate logs for these type of dropped traffic on the ASA 9.1 Version?
Any comments/suggestions are gladly appreciated :)
Regards,
John

I believe, but am not 100% sure, that the reason you are not seeing the ACL drop but a no NAT matched is because of the changes from 8.2 to 8.3 in the order of how things are done. In 8.3 and later you need to secify the real IP address when allowing packets in, and this is because NAT happens before the ACL is matched. So since there is no match on the NAT the packet is dropped then and there, never reaching the stage where ACLs are checked.
As to seeing drops in the ACL log...You might want to try adding an ACL that matches the NATed IP...but I don't think you will have much success with that either. My guess is that there is no way around this...at least no way I know of.
Please remember to select a correct answer and rate helpful posts

Syslog - seperate log for router output ?

Similar Messages

Maybe you are looking for