<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So if I understand you correctly </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Change the logger to syslog and then redirect from there. richt ?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>Van:</b> Geist, Dan (CCI-Atlanta) <Dan.Geist@cox.com><br>
<b>Verzonden:</b> dinsdag 24 oktober 2023 15:51<br>
<b>Aan:</b> DDFR | Ronald Blaas <ronald.blaas@ddfr.nl>; kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Onderwerp:</b> Re: kea-dhcp remote syslog</span>
<div> </div>
</div>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;">It depends on how you want to manage your systems, but my preference is to let software do the things it’s best at. Kea can send to multiple logging targets,
but you’ll probably get better flexibility to store/mangle/redirect messages if you use a service designed for that. Syslog-ng (or rsyslog, logstash, etc.) have a lot more capabilities there.</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;">Also, using the native syslog target kea (as opposed to the file mode) will likely yield performance increase on heavily loaded system as file handles
are fairly expensive. Systemd’s logging facility is often incorporated at the core with outputs that are used by userspace apps like syslog-ng</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;">Dan</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<div id="x_mail-editor-reference-message-container">
<div style="padding: 3pt 0in 0in; border-top: 1pt solid rgb(181, 196, 223);">
<p style="margin: 0in 0in 12pt; font-family: Calibri, sans-serif; font-size: 10pt;">
<span style="font-size: 12pt; color: black;"><b>From: </b>Kea-users <kea-users-bounces@lists.isc.org> on behalf of DDFR | Ronald Blaas <ronald.blaas@ddfr.nl><br>
<b>Date: </b>Tuesday, October 24, 2023 at 9:39 AM<br>
<b>To: </b>kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject: </b>[EXTERNAL] [Kea-users] kea-dhcp remote syslog</span></p>
</div>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">Hi all,</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">I have read in the documentation that multiple loggers can be setup.</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">But I don't quit understand how to setup remote logging.</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">thus far we have setup our logging locally using this config:</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">"loggers": [</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> {</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> "name": "kea-dhcp4",</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> "output_options": [</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> {</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> "output": "/var/log/kea/kea-dhcp4.log"</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> }</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> ],</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> "severity": "INFO",</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> "debuglevel": 0</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;"> }</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">So how can we setup additional logging to be forwarded to our syslog server? </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">(we are using syslog-ng locally) </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">Should we configure an additional logger to syslog, filter out the message locally and sent them to the remote
logger ?</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">Any help is appreciated</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">Regards,</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-family: Aptos, sans-serif; font-size: 12pt; color: black;">Ronald</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 10pt;"><span style="font-size: 11pt;"> </span></p>
</div>
</body>
</html>