How to enable syslogd to receive UDP logs from routers in OSX

StackOverflow https://stackoverflow.com/questions/1185554

  •  19-09-2019
  •  | 
  •  

Question

Occasionally a router goes bad and I would like to get the router logs.

While some routers have built-in log viewers, some do not. Most routers seem to have a facility to send logs to another host using syslog.

How do I get OSX (client) to receive these logs? OSX has a syslogd, but the instructions are opaque at best.

Perhaps a different client application would be better, but I'd prefer a way I could just hack up without downloading tools across the internet that has just broken down...

OSX does not have netcat, natively, otherwise I would have tried that.

Was it helpful?

Solution

Using syslog-ng which is probably available for OS X, although I am not certain, I capture syslog messages over my home network from my wifi router to my log server with the following 3 lines:

 source net { udp(); };

 destination wifirouter { file("/opt/var/log/wifirouter.log"); };

 log { source(net); destination(wifirouter); };

The wifi router was then configured to use use the log server's IP address and the wifirouter identifier. You could modify the source line to accept from only certain source IP addresses.

OTHER TIPS

The required "magic", with the stock Mac OS syslogd, is as follows.

Edit the launchd config for syslogd, /System/Library/LaunchDaemons/com.apple.syslogd.plist (you will need to be root, or use 'sudo vi' or your favourite other method to edit this.)

(Some versions seem to already have the necessary section commented out, but one of mine didn't.)

After the following:

 <key>Sockets</key>
 <dict>
 ...
     <key>BSDSystemLogger</key>
     <dict>
     ...
     </dict>

add in, or uncomment (remove the leading "" lines), this section:

     <key>NetworkListener</key>
     <dict>
          <key>SockServiceName</key>
          <string>syslog</string>
          <key>SockType</key>
          <string>dgram</string>
     </dict>

and then restart the syslogd completely (i.e. using launchctl, again as root) 

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

(I think this question/ answer probably belongs on superuser.com? Maybe someone can move it over.)

FYI, binary plist files can be edited using either the Property List Editor included with the XCode suite, or you can use the 3rd party editor Text Wrangler. I've not tried it, but I suspect BBEdit would be able to edit it as well considering it's lineage with TextWrangler.

From OS X 10.7 and above you should refer to this StackOverflow answer for this question.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top