Page MenuHomePhabricator

Configure VyOS to send syslog messages to remote syslog using fully-qualified domain name
Closed, ResolvedPublicFEATURE REQUEST

Description

I'd like the ability to set messages from rsyslog to remote loggers using the FQDN of the VyOS host. I was able to manually get this done by performing the following:

set system host-name my-vyos-host01
set system domain-name example.com
commit

Then I modified the /etc/rsyslog.conf file to include the following directive:

$PreserveFQDN on

Once that is done, restart rsyslog:

service rsyslog restart

Once done, i started receiving messages from my-vyos-host01.example.com instead of just the short name.

I would like to be able to set this as a boolean from the set of exposed VyOS commands, perhaps as:

set service syslog preserve-fqdn

Details

Difficulty level
Unknown (require assessment)
Version
-
Why the issue appeared?
Will be filled on close

Event Timeline

ddiguru created this task.Mar 6 2019, 3:28 PM
syncer assigned this task to hagbard.Mar 6 2019, 3:29 PM
syncer triaged this task as Normal priority.
ddiguru updated the task description. (Show Details)Mar 6 2019, 4:46 PM
c-po added a subscriber: c-po.Mar 6 2019, 4:49 PM

I prefere set service syslog preserve-hostname as we use hostname in other configuration nodes, too

ddiguru added a comment.EditedMar 6 2019, 5:16 PM

If you used set service syslog preserve-hostname, would you change the default rsyslog behavior to have $PreserveFQDN off?

set service syslog preserve-hostname would seem to mean "preserve the short-name" instead of FQDN or hostname.domain.name.

Maybe there are other better ways to ensure no ambiguity:

set service syslog use-domain-name
set service syslog use-full-hostname
set service syslog use-full-name
set service syslog include-domain-name

As a consultant in the DNS, DHCP and IPAM space, preserve-fqdn or use-fqdn makes a lot of sense to me as that's common lingo in my space.

just my 2 cents... Thanks

c-po added a comment.Mar 6 2019, 5:22 PM

I rather would prefer only one option. The more options you have for things to configure - the more trouble you get.

As backwards compatibility is a must with VyOS we should leave it as it is and should not set $PreserveFQDN off as default. A new command should be added to only enable this feature. As the syslog daemon already calls it PreserveFQDN we should use that configuration node, too when thinking about it, twice.

set service syslog preserve-fqdn works for me.

What about:
set system syslog global preserve-fqdn

ddiguru added a comment.EditedMar 7 2019, 8:35 PM

OOC why the term "global"? Do you foresee add'l global directives that you'd like added to that node or simply to keep things tidy under the syslog node?

Can you clarify please, I can't follow what you mean.

hagbard changed the task status from Open to In progress.Mar 7 2019, 9:08 PM

oh sorry, i was simply curious as to why you suggested adding the "global" node?

set service syslog preserve-fqdn
vs
set service syslog global preserve-fqdn

I suspect it's to prevent littering the service/syslog node itself...

hagbard changed the task status from In progress to Needs testing.Mar 7 2019, 9:23 PM

Tested using new rolling vyos-1.2.0-rolling+201903072319-amd64.iso

configure
set system syslog global preserve-fqdn
commit
save

searched these two files:

  • /etc/rsyslog.conf
  • /etc/rsyslog.d/vyos-rsyslog.conf

I noted the /etc/rsyslog.d/vyos-rsyslog.conf contains the $PreserveFQDN on option. Rsyslogd is restarted.

Graylog correctly contains FQDN source:

facility    security/authorization
level       6
message     vyos-lab-r01.ddiguru.net sshd[2367]: Received disconnect from 192.168.1.80: 11: disconnected by user
source      vyos-lab-r01.ddiguru.net
timestamp   2019-03-07 15:55:01.000 -07:00
hagbard closed this task as Resolved.Mar 7 2019, 11:05 PM

thx for testing.

syncer reopened this task as In progress.Mar 16 2019, 6:46 PM
syncer moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus board.
syncer added a subscriber: syncer.

@hagbard need this merged into the crux branch

pasik added a subscriber: pasik.Mar 17 2019, 3:02 PM