Syslog Server ! :-)

[dahlb]

2 FYI

1) you don't have to restart the synology just run /volume1/@appstore/SyslogServer/scripts/runscript.sh restart

2) if you get a bunch of emails your don't care about you can filter the mailed log entries by editing
/volume1/@appstore/SyslogServer/etc/template/filter_prior_mail.template
mine is
filter f_syno_mail {
level(_SYNO_PRIORITY_) and not program("synoautoblock|synoindexd|dhcpcd|ntpdate|hp");
};

[sjeph8je]

After the update to DSM 4.0, this seems to be changed. I have made the same changes to the system files, and nothing is showing up in the syslog server.

Anybody else experiencing this?

[CoolRaoul]

After the update to DSM 4.0, this seems to be changed. I have made the same changes to the system files, and nothing is showing up in the syslog server.

Anybody else experiencing this?

I Think that with DSM 4 you do not need to change the system files for this.

Just enable "syslog client", in control panel and set server to localhost or 127.0.0.1

[sjeph8je]

Hi,

I've seen this option and it looks promising but one thing that is not available is sending the log items from the /var/log/messages to the syslog server. With the change mentioned to the system file these messages could be added to the syslog server. These messages also contained far more detail than in the /var/log/messages file.

Synology somehow came up with a way to break this, perhaps someone with more linux background can shed some light?

[CoolRaoul]

Oh, you're right

In fact I think there a great amount of bugs remaining in syslog subsystem on 4.0,

one example:

Code: Select all

FSERV> /usr/syno/etc/rc.d/S22syslogng.sh start
Syslog-ng server start...
sh: or: unknown operand
sh: or: unknown operand
sh: or: unknown operand
sh: or: unknown operand
sh: or: unknown operand
sh: or: unknown operand
sh: or: unknown operand


The bug is inside the script "/usr/syno/syslogclient/scripts/runscript.sh"

Code: Select all

       if [ -n "${fac}" ]; then
           if [ -z ${SYSLOGNG_FAC_FILTER_STRING} ]; then
              SYSLOGNG_FAC_FILTER_STRING="program(${fac})"
           else
              SYSLOGNG_FAC_FILTER_STRING="${SYSLOGNG_FAC_FILTER_STRING} or program(${fac})"
           fi
       fi


There should be quotes around "${SYSLOGNG_FAC_FILTER_STRING}", like this

Code: Select all

           if [ -z "${SYSLOGNG_FAC_FILTER_STRING}" ]; then


Another one, inside the file "/usr/syno/etc/rc.d/S22syslogng.sh":

Code: Select all

        if [ "yes" == SYSLOGNG_SERVER_ENABLE ]; then
            #When booting, leave this action for real run script if server is enable
            echo "Leave start action for server run script"
            exit;
        fi


the "if" test is always false because the "$" has been forgotten, should have been:

Code: Select all

        if [ "yes" == $SYSLOGNG_SERVER_ENABLE ]; then

and the value of that variable comes from the code:

[code]    SYSLOGNG_SERVER_ENABLE=`/bin/get_key_value ${FILE_SYSLOGNG_SETTING} server_enable`

but the value of "FILE_SYSLOGNG_SETTING" is "/usr/syno/etc/synosyslog/setting.conf" which *does not exists*!

Do you think synology dev team eople is already aware of those problems?

[maxxfi]

Oh, you're right

In fact I think there a great amount of bugs remaining in syslog subsystem on 4.0,

(Oh, great... )

Do you think synology dev team eople is already aware of those problems?

Well, I suggest that you file a bug about those issues anyway

[sjeph8je]

Yeah,

I think so too, keep us informed if you do

[CoolRaoul]

Yeah,

I think so too, keep us informed if you do

Done

stay tuned;

[CoolRaoul]

another bug found:

Code: Select all

$ /usr/local/etc/rc.d/SyslogServer.sh start
sh: 1: unknown operand
sh: 1: unknown operand
sh: 1: unknown operand
sh: 1: unknown operand
sh: 2197: unknown operand

Explanation:
inside the script there is the following line

Code: Select all

PACKAGE_LIMIT=`get_key_value ${DSM_CONFIG} ${PACKAGE_LIMIT_KEY}`

"get_key_value" returns an empty string, because the value of PACKAGE_LIMIT_KEY (currently "synosyslog_limit") is not present in /etc.defaults/synoinfo.conf (value of ${DSM_CONFIG})

New support ticket opened

[CoolRaoul]

No answer from support yet, but I've been able to found a working configuration.

Fisrt apply the following fixes:

• File: "/usr/syno/etc/rc.d/S22syslogng.sh"
  

  Code: Select all

  -- FILE_SYSLOGNG_SETTING=/usr/syno/etc/synosyslog/setting.conf
++ FILE_SYSLOGNG_SETTING=/etc/synosyslog.conf


  and
  

  Code: Select all

  -- if [ "yes" == SYSLOGNG_SERVER_ENABLE ]; then       
++ if [ "yes" == $SYSLOGNG_SERVER_ENABLE ]; then

  
  
• File: "/usr/syno/syslogclient/scripts/runscript.sh"
  

  Code: Select all

  -- if [ -z ${SYSLOGNG_FAC_FILTER_STRING} ]; then
++ if [ -z "${SYSLOGNG_FAC_FILTER_STRING}" ]; then


  
  
• File: "/usr/local/etc/rc.d/SyslogServer.sh"
  The errors can by ignored.

Then, add those lines at the end of "/usr/syno/syslogclient/etc/system.conf":

Code: Select all

source s_system_local { unix-stream("/var/run/log"); };
log { source(s_system_local);  filter(f_syno_client_sev); destination(d_syno_internet); flags(flow_control); };

Syslog server and client have to be restarted
Since I'm unable to garantee the correct order of operations, I think the best is simply to restart the Synology

[sjeph8je]

Thanks for the good work,

Will try later today, as I have no way of doing it now, will let you know how it works out

Hope Synology will fix this soon.

Best regards,