You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

opHA can send syslogs using escalation or send syslogs at the same time as the events are logged to the local file, which is basically realtime, this bypasses using the escalation system.

Master Configuration

We need to make sure the Master is setup to receive logs, the following documentation is for rsyslog. 
Edit the rsyslog config /etc/rsyslog.conf, make sure it is willing to accept logs, and that the facility used above is going into the slave_event_log

# Provides UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 514

#slave NMIS servers use local1 by default, capture that into slave_event.log
local1.*                                                /usr/local/nmis8/logs/slave_event.log

 

Now make sure rsyslog is running. 
service rsyslog restart

Slave Configuration

Now configure NMIS slaves to send their logs through syslog to your master server. To run events through syslog check this config setting:
'syslog_events' => 'true'

Then make sure the config has the correct settings for the Master syslog service, specifically make sure the syslog_server points to the correct host, proto and port: 

'syslog' => {
    'syslog_events' => 'true',
    'syslog_facility' => 'local1',
    'syslog_server' => 'master.ip.address:udp:514',
    'syslog_use_escalation' => 'false'
  },

To run Escalations on events before syslog:

To run events through escalations before putting them into syslog:
'syslog_use_escalation' => 'true'

No Escalations on events before syslog:

To have events go directly into syslog without escalations
'syslog_use_escalation' => 'false'

This will use the Common-events model to determine which events should be sent as syslogs, by default all events will be sent, except for some of those events for deleted interfaces, etc.

Testing

On the slave run: 

[root@slave nmis8]#/usr/local/nmis8/admin/testsyslog.pl

On the master you should see the event (in the GUI as well if you refresh) 

[root@master logs]# tail -f /usr/local/nmis8/logs/slave_event.log
Jan  5 10:24:42 demo testsyslog.pl[20840]: NMIS_Event::demo::1420417479,demo,Test Event,Normal,,
  • No labels