Agenda: exercises-log-management-syslog-ng.htm

File exercises-log-management-syslog-ng.htm, 9.8 KB (added by admin, 5 years ago)
Line 
1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2<html xmlns="http://www.w3.org/1999/xhtml">
3<head>
4  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5  <meta http-equiv="Content-Style-Type" content="text/css" />
6  <meta name="generator" content="pandoc" />
7  <title>Network Management &amp; Monitoring</title>
8  <style type="text/css">code{white-space: pre;}</style>
9  <link rel="stylesheet" href="../../style.css" type="text/css" />
10</head>
11<body>
12<div id="header">
13<h1 class="title">Network Management &amp; Monitoring</h1>
14</div>
15<div id="TOC">
16<ul>
17<li><a href="#introduction"><span class="toc-section-number">1</span> Introduction</a><ul>
18<li><a href="#goals"><span class="toc-section-number">1.1</span> Goals</a></li>
19<li><a href="#notes"><span class="toc-section-number">1.2</span> Notes</a></li>
20</ul></li>
21<li><a href="#exercises"><span class="toc-section-number">2</span> Exercises</a></li>
22<li><a href="#configure-your-virtual-routers-to-send-syslog-messages-to-your-server"><span class="toc-section-number">3</span> 1. Configure your virtual routers to send syslog messages to your server:</a></li>
23<li><a href="#install-syslog-ng"><span class="toc-section-number">4</span> 2. Install syslog-ng</a></li>
24<li><a href="#edit-etcsyslog-ngsyslog-ng.conf"><span class="toc-section-number">5</span> 3. Edit /etc/syslog-ng/syslog-ng.conf</a></li>
25<li><a href="#create-the-directory-varlognetwork"><span class="toc-section-number">6</span> 4. Create the directory /var/log/network/</a></li>
26<li><a href="#restart-syslog-ng"><span class="toc-section-number">7</span> 5. Restart syslog-ng:</a></li>
27<li><a href="#test-syslog"><span class="toc-section-number">8</span> 6. Test syslog</a></li>
28<li><a href="#troubleshooting"><span class="toc-section-number">9</span> Troubleshooting</a></li>
29</ul>
30</div>
31<h1 id="introduction"><a href="#introduction"><span class="header-section-number">1</span> Introduction</a></h1>
32<h2 id="goals"><a href="#goals"><span class="header-section-number">1.1</span> Goals</a></h2>
33<ul>
34<li>Learn how to use syslog-ng to manage logs.</li>
35</ul>
36<h2 id="notes"><a href="#notes"><span class="header-section-number">1.2</span> Notes</a></h2>
37<ul>
38<li>Commands preceded with &quot;$&quot; imply that you should execute the command as a general user - not as root.</li>
39<li>Commands preceded with &quot;#&quot; imply that you should be working as root.</li>
40<li>Commands with more specific command lines (e.g. &quot;rtrX&gt;&quot; or &quot;mysql&gt;&quot;) imply that you are executing commands on remote equipment, or within another program.</li>
41</ul>
42<h1 id="exercises"><a href="#exercises"><span class="header-section-number">2</span> Exercises</a></h1>
43<p>Please find your classmates that are using the same router as you. Get in to a group and do the following exercise together. That is, pick one person who will log in to your group's router, but all of you should assist with the actual configuration.</p>
44<h1 id="configure-your-virtual-routers-to-send-syslog-messages-to-your-server"><a href="#configure-your-virtual-routers-to-send-syslog-messages-to-your-server"><span class="header-section-number">3</span> 1. Configure your virtual routers to send syslog messages to your server:</a></h1>
45<p>The routers are able to send syslog messages to multiple destinations, so that 1 router can send messages to 4 or even 5 destinations. We therefore need to configure the router to send messages to each of the PCs in the group.</p>
46<p>You will SSH to your group's router and do the following:</p>
47<pre><code>$ ssh cisco@10.10.X.254
48rtrX&gt; enable
49rtrX# config terminal</code></pre>
50<p>Repeat the next command &quot;logging 10.10.X.Y&quot; for each PC in your group. That is, if your group is on router 6 and you are using pcs 21, 22, 23 and 24 you would repeat the command four times with the ip of each machine (10.10.6.21, 10.10.6.22, and so forth).</p>
51<pre><code>rtrX(config)# logging 10.10.X.Y
52...
53rtrX(config)# logging facility local0
54rtrX(config)# logging userinfo
55rtrX(config)# exit
56rtrX# write memory</code></pre>
57<p>Now run 'show logging' to see the summary of the logging configuration.</p>
58<pre><code>rtrX# show logging</code></pre>
59<p>Logout from the router (exit)</p>
60<pre><code>rtrX# exit</code></pre>
61<p>That's it. The router should now be sending UDP SYSLOG packets to your PC on port 514. To verify this log in on your PC and do the following:</p>
62<pre><code>$ sudo -s
63# apt-get install tcpdump        (don&#39;t worry if it&#39;s already installed)
64# tcpdump -s0 -nv -i eth0 port 514</code></pre>
65<p>Then have one person in your group log back in on the router and do the following:</p>
66<pre><code>$ ssh cisco@10.10.X.254
67rtrX&gt; enable
68rtrX# config terminal
69(config)# exit
70rtrX&gt; exit</code></pre>
71<p>You should see some output on your PC's screen from TCPDUMP. It should look something like:</p>
72<pre><code>08:01:12.154604 IP (tos 0x0, ttl 255, id 11, offset 0, flags [none], proto UDP (17), length 138)
73    10.10.9.254.57429 &gt; 10.10.9.36.514: SYSLOG, length: 110
74    Facility local0 (16), Severity notice (5)
75    Msg: 23: *Feb 19 08:01:10.855: %SYS-5-PRIV_AUTH_PASS: Privilege level set to 15 by cisco on vty0 (10.10.0.117)
7608:01:15.519881 IP (tos 0x0, ttl 255, id 12, offset 0, flags [none], proto UDP (17), length 130)
77    10.10.9.254.57429 &gt; 10.10.9.36.514: SYSLOG, length: 102
78    Facility local0 (16), Severity notice (5)
79    Msg: 24: *Feb 19 08:01:14.215: %SYS-5-CONFIG_I: Configured from console by cisco on vty0 (10.10.0.117)</code></pre>
80<p>Now you can configure the logging software on your PC to receive this information and log it to a new set of files.</p>
81<h1 id="install-syslog-ng"><a href="#install-syslog-ng"><span class="header-section-number">4</span> 2. Install syslog-ng</a></h1>
82<p>These exercises are done as root. If you are not root on your machine then become root by typing:</p>
83<pre><code>$ sudo -s
84# apt-get install syslog-ng</code></pre>
85<h1 id="edit-etcsyslog-ngsyslog-ng.conf"><a href="#edit-etcsyslog-ngsyslog-ng.conf"><span class="header-section-number">5</span> 3. Edit /etc/syslog-ng/syslog-ng.conf</a></h1>
86<p>Find the lines:</p>
87<pre><code>source s_src {
88       system();
89       internal();
90};</code></pre>
91<p>and change them to:</p>
92<pre><code>source s_src {
93       system();
94       internal();
95       udp();
96};</code></pre>
97<p>Save the file and exit.</p>
98<p>Now, create a config section for our network logs:</p>
99<pre><code># cd /etc/syslog-ng/conf.d/
100# editor 10-network.conf</code></pre>
101<p>In this file, copy and paste the following:</p>
102<pre><code>    filter f_routers { facility(local0); };
103
104    log {
105            source(s_src);
106            filter(f_routers);
107            destination(routers);
108    };
109
110    destination routers {
111     file(&quot;/var/log/network/$YEAR/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY-$HOUR.log&quot;
112     owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)
113     template(&quot;$YEAR $DATE $HOST $MSG\n&quot;));
114    };</code></pre>
115<p>Save the file and exit.</p>
116<h1 id="create-the-directory-varlognetwork"><a href="#create-the-directory-varlognetwork"><span class="header-section-number">6</span> 4. Create the directory /var/log/network/</a></h1>
117<pre><code># mkdir /var/log/network/</code></pre>
118<h1 id="restart-syslog-ng"><a href="#restart-syslog-ng"><span class="header-section-number">7</span> 5. Restart syslog-ng:</a></h1>
119<pre><code># service syslog-ng restart</code></pre>
120<h1 id="test-syslog"><a href="#test-syslog"><span class="header-section-number">8</span> 6. Test syslog</a></h1>
121<p>To be sure there are some logging messages log back in to the router, and run some &quot;config&quot; commands, then logout. e.g.</p>
122<pre><code># ssh cisco@10.10.X.254
123rtrX&gt; enable
124rtrX# config terminal
125rtrX(config)# exit
126rtrX&gt; exit</code></pre>
127<p>Be sure you log out of the router. If too many people log in without logging out then others cannot gain access to the router.</p>
128<ol start="7" style="list-style-type: decimal">
129<li>On your PC, See if messages are starting to appear under /var/log/network/2013/.../</li>
130</ol>
131<pre><code>$ cd /var/log/network
132$ ls
133$ cd 2014
134$ ls
135... this will show you the directory for the month
136... cd into this directory
137$ ls
138... repeat for the next level (the day of the month)
139$ ls</code></pre>
140<p>You can view the resulting log file by using a pager program such as less, more, cat, etc...</p>
141<h1 id="troubleshooting"><a href="#troubleshooting"><span class="header-section-number">9</span> Troubleshooting</a></h1>
142<p>If no files are appearing under the /var/log/network directory, then another command to try while logged into the router, in config mode, is to shutdown / no shutdown a Loopback interface, for example:</p>
143<pre><code>$ ssh cisco@rtrX
144
145rtrX&gt; enable
146rtrX# conf t
147rtrX(config)# interface Loopback 999
148rtrX(config-if)# shutdown</code></pre>
149<p>wait a few seconds</p>
150<pre><code>rtrX(config-if)# no shutdown</code></pre>
151<p>Then exit, and save the config (&quot;write mem&quot;):</p>
152<pre><code>rtrX(config-if)# exit
153rtrX(config)# exit
154rtrX# write memory
155rtr1# exit</code></pre>
156<p>Check the logs under <code>/var/log/network</code></p>
157<pre><code># cd /var/log/network
158# ls</code></pre>
159<p>...follow the directory trail</p>
160<p>Still no logs?</p>
161<p>Try the following command to send a test log message locally:</p>
162<pre><code>    # logger -p local0.info &quot;Hello World\!&quot;</code></pre>
163<p>If a file has not been created yet under <code>/var/log/network</code>, then check your configuration for typos. Don't forget to restart the syslog-ng service each time you change the configuration.</p>
164<p>What other commands can you think of that you can run on the router (BE CAREFUL!) that will trigger syslog messages? You could try logging in on the router and typing an incorrect password for &quot;enable&quot;.</p>
165<p>Be sure that you do an &quot;ls&quot; command in your logging directory to see if a new log file has been created at some point.</p>
166</body>
167</html>