<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">If you’re wanting to use external logging targets and more advanced processing, then yes, that would be my choice.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">DDFR | Ronald Blaas <ronald.blaas@ddfr.nl><br>
<b>Date: </b>Tuesday, October 24, 2023 at 9:53 AM<br>
<b>To: </b>Geist, Dan (CCI-Atlanta) <Dan.Geist@cox.com>, kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject: </b>[EXTERNAL] Re: kea-dhcp remote syslog<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">So if I understand you correctly <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Change the logger to syslog and then redirect from there. richt ?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:11.0pt">
<hr size="0" width="100%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">Van:</span></b><span style="font-size:11.0pt;color:black"> Geist, Dan (CCI-Atlanta) <Dan.Geist@cox.com><br>
<b>Verzonden:</b> dinsdag 24 oktober 2023 15:51<br>
<b>Aan:</b> DDFR | Ronald Blaas <ronald.blaas@ddfr.nl>; kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Onderwerp:</b> Re: kea-dhcp remote syslog</span><span style="font-size:11.0pt">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
</div>
</div>
<p><span style="font-size:11.0pt">It depends on how you want to manage your systems, but my preference is to let software do the things it’s best at. Kea can send to multiple logging targets, but you’ll probably get better flexibility to store/mangle/redirect
messages if you use a service designed for that. Syslog-ng (or rsyslog, logstash, etc.) have a lot more capabilities there.</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p><span style="font-size:11.0pt">Also, using the native syslog target kea (as opposed to the file mode) will likely yield performance increase on heavily loaded system as file handles are fairly expensive. Systemd’s logging facility is often incorporated at
the core with outputs that are used by userspace apps like syslog-ng</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p><span style="font-size:11.0pt">Dan</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div id="x_mail-editor-reference-message-container">
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Kea-users <kea-users-bounces@lists.isc.org> on behalf of DDFR | Ronald Blaas <ronald.blaas@ddfr.nl><br>
<b>Date: </b>Tuesday, October 24, 2023 at 9:39 AM<br>
<b>To: </b>kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject: </b>[EXTERNAL] [Kea-users] kea-dhcp remote syslog</span><o:p></o:p></p>
</div>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Hi all,</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">I have read in the documentation that multiple loggers can be setup.</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">But I don't quit understand how to setup remote logging.</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">thus far we have setup our logging locally using this config:</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">"loggers": [</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> {</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> "name": "kea-dhcp4",</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> "output_options": [</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> {</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> "output": "/var/log/kea/kea-dhcp4.log"</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> }</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> ],</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> "severity": "INFO",</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> "debuglevel": 0</span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black"> }</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">So how can we setup additional logging to be forwarded to our syslog server? </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">(we are using syslog-ng locally) </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Should we configure an additional logger to syslog, filter out the message locally and sent them to the remote logger ?</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Any help is appreciated</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Regards,</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p><span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Ronald</span><o:p></o:p></p>
<p><span style="font-size:11.0pt"> </span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>