We have simple integration for Graylog, you will be able to view anylogs from within LibreNMS that have been parsed by the syslog inputfrom within Graylog itself. This includes logs from devices whicharen't in LibreNMS still, you can also see logs for a specific deviceunder the logs section for the device.
- Librenms Syslog Server
- Librenms Syslog Alerts
- Librenms Enable Syslog
- Librenms Syslog
- Librenms Syslog-ng Not Working
- Librenms Syslog Alert Template
Currently, LibreNMS does not associate shortnames from Graylog withfull FQDNS. If you have your devices in LibreNMS using full FQDNs,such as hostname.example.com, be aware that rsyslogd, by default,sends the shortname only. To fix this, add
$PreserveFQDN on
to your rsyslog config to send the full FQDN so device logs will beassociated correctly in LibreNMS. Also see near the bottom of thisdocument for tips on how to enable/suppress the domain part ofhostnames in syslog-messages for some platforms.
I misinterpreted the LibreNMS docker page by thinking that the LibreNMS container came with a MariaDB instance pre-installed. So the above commands will create a LibreNMS container, a LibreNMS syslog-ng 'sidecar' container for syslog capabilities within LibreNMS, and a MariaDB container. All are necessary for it to work. Looking at syslog and eventlog messages in LibreNMS. We also look at alerting on syslog messages. Example output: Mar 22 00:59:03 librenms.host.net librenms233: Critical network.device.net: Port Down - portid = 98939; ifDescr = xe-1/1/0; Each fault will be sent as a separate syslog. All the list.logs calls are aliased to listlogs. Retrieve all logs or logs for a specific device. Id or hostname is the specific device. Input: start: The page number to request. Limit: The limit of results to be returned. From: The date and time or the event id to search from. To: The data and time or the event id to search to.
Graylog itself isn't included within LibreNMS, you will need toinstall this separately either on the same infrastructure as LibreNMSor as a totally standalone appliance.
Config is simple, here's an example based on Graylog 2.4:
Timezone
Graylog messages are stored using GMT timezone. You can displaygraylog messages in LibreNMS webui using your desired timezone bysetting the following option in config.php:
Timezone must be PHP supported timezones, available at:https://php.net/manual/en/timezones.php
Graylog Version
If you are running a version earlier than Graylog then please set
to the version number of your Grayloginstall. Earlier versions than 2.1 use the default port 12900
URI
If you have altered the default uri for your Graylog setup then youcan override the default of
/api/
usingUser Credentials
If you choose to use another user besides the admin user, please notethat currently you must give the user 'admin' permissions from withinGraylog, 'read' permissions alone are not sufficient.
TLS Certificate
If you have enabled TLS for the Graylog API and you are using aself-signed certificate, please make sure that the certificate istrusted by your LibreNMS host, otherwise the connection willfail. Additionally, the certificate's Common Name (CN) has to matchthe FQDN or IP address specified in
Match Any Address
If you want to match the source address of the log entries against anyIP address of a device instead of only against the primary address andthe host name to assign the log entries to a device, you can activatethis function using
Recent Devices
There are 2 configuration parameters to influence the behaviour of the'Recent Graylog' table on the overview page of thedevices.
Sets the maximum number of rows to be displayed (default: 10)
Librenms Syslog Server
You can set which loglevels that should be displayed on the overview page. (default: 7, min:0, max: 7)
Shows only entries with a log level less than or equal to 4 (Emergency,Alert, Critical, Error, Warning).You can set a default Log Level Filter with
(applies to /graylog and /device/device=/tab=logs/section=graylog/ (min: 0, max: 7)Librenms Syslog Alerts
Domain and hostname handling
Librenms Enable Syslog
Suppressing/enabling the domain part of a hostname for specific platforms
You should see if what you get in syslog/Graylog matches up with yourconfigured hosts first. If you need to modify the syslog messages fromspecific platforms, this may be of assistance:
Librenms Syslog
IOS (Cisco)
Librenms Syslog-ng Not Working
or
Librenms Syslog Alert Template
JunOS (Juniper Networks)
PanOS (Palo Alto Networks)
or