Description

This KB introduces an example regarding syslog setting on EVO, so it might change the messages format, then it would affect the file name or location on syslog server side.

Symptoms

By default, it will make the syslog server save multi directories/names, which depends on the nodes being installed on EVO.
The EVO DUT is a ptx10004 which holds four nodes (fpc0/fpc1/re0/re1) with the following configuration:
---------------------------
show configuration system 
host-name test-router;
syslog {
    archive size 10m files 5;
    host 10.100.240.2 {
        any any;
        allow-duplicates;
        log-prefix test;
        source-address 10.100.240.1;
        structured-data;
    }
    file messages {
        any any;
        authorization info;
        archive size 1m files 10;
    }
    console {
        any verbose;
    }
    time-format millisecond;
}
---------------------------
# Syslog server is rsyslog app with a very simple cfg.

Solution

The solution is that it must enable this knob "set system syslog alternate-format" on syslog which would change it to only one file or one directory.

Before the change, it will make four directories on syslog server.
---------------------------------------------------------
drwxrwxrwx   2 syslog            syslog               4096 Sep 26 11:40 teste-router-fpc0
drwxrwxrwx   2 syslog            syslog               4096 Sep 26 11:40 teste-router-fpc1
drwxrwxrwx   2 syslog            syslog               4096 Sep 26 11:40 teste-router-re0
drwxrwxrwx   2 syslog            syslog               4096 Sep 26 11:41 teste-router-re1
---------------------------------------------------------

11:41:18.165106 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 212: (tos 0x0, ttl 64, id 17476, offset 0, flags [DF], proto UDP (17), length 150)
    10.100.240.1.syslog > 10.100.240.2.syslog: [udp sum ok] SYSLOG, length: 122
        Facility auth (4), Severity info (6)
        Msg: Sep 30 11:41:17 test-router-re0 test: sshd[8340]: Did not receive identification string from 172.29.147.115 port 57532
        0x0000:  3c33 383e 5365 7020 3330 2031 313a 3431
        0x0010:  3a31 3720 7465 7374 2d72 6f75 7465 722d
        0x0020:  7265 3020 7465 7374 3a20 7373 6864 5b38
        0x0030:  3334 305d 3a20 4469 6420 6e6f 7420 7265
        0x0040:  6365 6976 6520 6964 656e 7469 6669 6361
        0x0050:  7469 6f6e 2073 7472 696e 6720 6672 6f6d
        0x0060:  2031 3732 2e32 392e 3134 372e 3131 3520
        0x0070:  706f 7274 2035 3735 3332
        0x0000:  4500 0096 4444 4000 4011 0147 0a64 f001  E...DD@[email protected]..
        0x0010:  0a64 f002 0202 0202 0082 48c8 3c33 383e  .d........H.<38>
        0x0020:  5365 7020 3330 2031 313a 3431 3a31 3720  Sep.30.11:41:17.
        0x0030:  7465 7374 2d72 6f75 7465 722d 7265 3020  test-router-re0.<<<<<<<<<<<<there is a "-" between tester-router  and re0, then it connects to log-prefx with "." 
        0x0040:  7465 7374 3a20 7373 6864 5b38 3334 305d  test:.sshd[8340]
        0x0050:  3a20 4469 6420 6e6f 7420 7265 6365 6976  :.Did.not.receiv
        0x0060:  6520 6964 656e 7469 6669 6361 7469 6f6e  e.identification
        0x0070:  2073 7472 696e 6720 6672 6f6d 2031 3732  .string.from.172
        0x0080:  2e32 392e 3134 372e 3131 3520 706f 7274  .29.147.115.port
        0x0090:  2035 3735 3332                           .57532

---------------------------------------------------------
Sep 30 11:48:26.170  test-router-re1 systemd-logind[7041]: Session c521 logged out. Waiting for processes to exit.
Sep 30 11:48:26.173  test-router-re1 rshd[31150]: pam_unix(rsh:session): session closed for user root
Sep 30 11:48:26.177  test-router-re1 systemd[1]: session-c521.scope: Succeeded.
Sep 30 11:48:26.178  test-router-re1 systemd-logind[7041]: Removed session c521.
Sep 30 11:48:26.102  test-router-re0 replicate-commit-meta.sh[26426]: : Copying //var/rundb/db_sequence.last to 128.0.0.5://var/rundb/db_sequence.last+
Sep 30 11:48:26.968  test-router-re0 mgd[18166]: UI_CMDLINE_READ_LINE: User 'labroot', command 'exit '
Sep 30 11:48:26.982  test-router-re0 mgd[18166]: UI_DBASE_LOGOUT_EVENT: User 'labroot' exiting configuration mode
Sep 30 11:48:28.390  test-router-re0 sshd[27290]: /etc/ssh/sshd_config line 130: Deprecated option UsePrivilegeSeparation
---------------------------------------------------------

After the change, it will create only one directory on syslog server.
---------------------------------------------------------
drwxrwxrwx   2 syslog            syslog              4096 Sep 30 09:39 test-router
---------------------------------------------------------
11:43:59.062068 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 174: (tos 0x0, ttl 64, id 22251, offset 0, flags [DF], proto UDP (17), length 112)
    10.100.240.1.syslog > 10.100.240.2.syslog: [udp sum ok] SYSLOG, length: 84
        Facility kernel (0), Severity info (6)
        Msg: Sep 30 11:43:58 test-router test: re0-kernel: device iri entered promiscuous mode
        0x0000:  3c36 3e53 6570 2033 3020 3131 3a34 333a
        0x0010:  3538 2074 6573 742d 726f 7574 6572 2074
        0x0020:  6573 743a 2072 6530 2d6b 6572 6e65 6c3a
        0x0030:  2064 6576 6963 6520 6972 6920 656e 7465
        0x0040:  7265 6420 7072 6f6d 6973 6375 6f75 7320
        0x0050:  6d6f 6465
        0x0000:  4500 0070 56eb 4000 4011 eec5 0a64 f001  E..pV.@[email protected]..
        0x0010:  0a64 f002 0202 0202 005c 9515 3c36 3e53  .d.......\..<6>S
        0x0020:  6570 2033 3020 3131 3a34 333a 3538 2074  ep.30.11:43:58.t
        0x0030:  6573 742d 726f 7574 6572 2074 6573 743a  est-router.test:     <<<<<the format changes to test-router.test.re0",  so it is “." to separate log-prefix and hostname.
        0x0040:  2072 6530 2d6b 6572 6e65 6c3a 2064 6576  .re0-kernel:.dev
        0x0050:  6963 6520 6972 6920 656e 7465 7265 6420  ice.iri.entered.
        0x0060:  7072 6f6d 6973 6375 6f75 7320 6d6f 6465  promiscuous.mode

 ---------------------------------------------------------
Sep 30 11:45:15.645  test-router re1-systemd[1]: Stopped User Runtime Directory /run/user/0.
Sep 30 11:45:15.647  test-router re1-systemd[1]: Removed slice User Slice of UID 0.
Sep 30 11:45:20.625  test-router re0-sshd[19883]: /etc/ssh/sshd_config line 130: Deprecated option UsePrivilegeSeparation
Sep 30 11:45:20.631  test-router re0-sshd[19883]: Did not receive identification string from 172.29.147.113 port 50956
Sep 30 11:45:41.996  test-router re0-sshd[20537]: /etc/ssh/sshd_config line 130: Deprecated option UsePrivilegeSeparation
Sep 30 11:45:42.003  test-router re0-sshd[20537]: Did not receive identification string from 10.104.57.37 port 56804
Sep 30 11:46:01.179  test-router re1-CROND[27143]: (root) CMD (   test ! -f /tmp/.pkid_sync_done && /usr/sbin/pkid-sync.sh > /dev/null 2>&1)
Sep 30 11:46:01.181  test-router re1-CROND[27144]: (root) CMD (/bin/bash /usr/sbin/manage_fpc_logs.sh)
Sep 30 11:46:01.227  test-router re0-CROND[21171]: (root) CMD (/bin/bash /usr/sbin/manage_fpc_logs.sh)
Sep 30 11:46:01.227  test-router re0-CROND[21172]: (root) CMD (   test ! -f /tmp/.pkid_sync_done && /usr/sbin/pkid-sync.sh > /dev/null 2>&1)
Sep 30 11:47:01.192  test-router re1-CROND[28667]: (root) CMD (   test ! -f /tmp/.pkid_sync_done && /usr/sbin/pkid-sync.sh > /dev/null 2>&1)
Sep 30 11:47:01.193  test-router re1-CROND[28668]: (root) CMD (/bin/bash /usr/sbin/manage_fpc_logs.sh)
Sep 30 11:47:01.237  test-router re0-CROND[23172]: (root) CMD (/bin/bash /usr/sbin/manage_fpc_logs.sh)
Sep 30 11:47:01.243  test-router re0-CROND[23173]: (root) CMD (   test ! -f /tmp/.pkid_sync_done && /usr/sbin/pkid-sync.sh > /dev/null 2>&1)
 ---------------------------------------------------------
 

Modification History

2024-09-27 : Article Created

Related Information

Case:2024-0925-269624