From: Harald Welte <laforge@gnumonks.org>
To: Seetharaman <seetharamang17@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: Regarding ulogd_output_SYSLOG.so
Date: Fri, 12 Jul 2024 10:49:26 +0200 [thread overview]
Message-ID: <ZpDuFmbSr3uXZdIs@nataraja> (raw)
In-Reply-To: <CAOWAF3y694=sQhW0oTtm8pKnbP=_mP02=cKcFk6pLUehjDrCyQ@mail.gmail.com>
Hi Steetharaman,
On Fri, Jul 12, 2024 at 12:02:02PM +0530, Seetharaman wrote:
> I am trying to use ulogd in the openwrt system to send the logs captured
> using NFLOG to a remote syslog server.
I don't think this is something that is implemented. You'd have to run a local syslogd
which then forwards it to a remote machine.
Or, alternatively, you would need to implement an output plugin that implements the remote syslog
prtoocol (https://datatracker.ietf.org/doc/html/rfc5424). Should be rather easy: Simply open a UDP
socket and then format the packets into strings and send it over said UDP socket.
> I am using below ulogd configuration:
>
> [global]
> loglevel="5"
> logfile="/var/log/ulogd.log"
> plugin="/usr/lib/ulogd/ulogd_inppkt_NFLOG.so"
> plugin="/usr/lib/ulogd/ulogd_filter_IFINDEX.so"
> plugin="/usr/lib/ulogd/ulogd_filter_IP2STR.so"
> plugin="/usr/lib/ulogd/ulogd_filter_PRINTPKT.so"
> plugin="/usr/lib/ulogd/ulogd_output_SYSLOG.so"
> plugin="/usr/lib/ulogd/ulogd_raw2packet_BASE.so"
> stack="log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,sys1:SYSLOG"
> network="lan"
> [log1]
> group="1"
> *[sys1]*
> *host="10.0.0.1"*
> *port="514"*
where did you find the instructions that those config options are valid? Did you see
any such example anywhere?
http://git.netfilter.org/ulogd2/tree/output/ulogd_output_SYSLOG.c#n48
clearly only registers the "facility" and "level" options, and nothing else.
> But the logs are being sent to the local syslog daemon instead of remote
> syslog daemon.
no surprise, as you're doing something the code clearly was not designed for, and which I don't believe
we ever claimed should work.
> Does ulogd_output_SYSLOG.so really supports remote logging?
No. Why do you think it would? where did you find such information?
--
- Harald Welte <laforge@gnumonks.org> https://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
parent reply other threads:[~2024-07-12 8:55 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <CAOWAF3y694=sQhW0oTtm8pKnbP=_mP02=cKcFk6pLUehjDrCyQ@mail.gmail.com>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZpDuFmbSr3uXZdIs@nataraja \
--to=laforge@gnumonks.org \
--cc=netfilter@vger.kernel.org \
--cc=seetharamang17@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).