ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    SysLog Forwarding for XenServer

    Scheduled Pinned Locked Moved IT Discussion
    rsyslogxenserverloggingkibanaelkelasticsearch
    110 Posts 10 Posters 25.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DustinB3403D
      DustinB3403
      last edited by

      So in checking out the firewall on the Kibana server using nmap...

      Starting Nmap 6.40 ( http://nmap.org ) at 2016-08-16 09:34 EDT
      Nmap scan report for localhost (127.0.0.1)
      Host is up (0.000089s latency).
      Other addresses for localhost (not scanned): 127.0.0.1
      Not shown: 996 closed ports
      PORT     STATE SERVICE
      22/tcp   open  ssh
      25/tcp   open  smtp
      80/tcp   open  http
      9200/tcp open  wap-wsp
      No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
      TCP/IP fingerprint:
      OS:SCAN(V=6.40%E=4%D=8/16%OT=22%CT=1%CU=32095%PV=N%DS=0%DC=L%G=Y%TM=57B3166
      OS:E%P=x86_64-redhat-linux-gnu)SEQ(SP=104%GCD=1%ISR=10A%TI=Z%CI=I%II=I%TS=A
      OS:)OPS(O1=MFFD7ST11NW7%O2=MFFD7ST11NW7%O3=MFFD7NNT11NW7%O4=MFFD7ST11NW7%O5
      OS:=MFFD7ST11NW7%O6=MFFD7ST11)WIN(W1=AAAA%W2=AAAA%W3=AAAA%W4=AAAA%W5=AAAA%W
      OS:6=AAAA)ECN(R=Y%DF=Y%T=40%W=AAAA%O=MFFD7NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S
      OS:=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%R
      OS:D=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=
      OS:0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U
      OS:1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DF
      OS:I=N%T=40%CD=S)
      
      Network Distance: 0 hops
      
      OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
      Nmap done: 1 IP address (1 host up) scanned in 12.68 seconds
      
      travisdh1T 1 Reply Last reply Reply Quote 0
      • travisdh1T
        travisdh1 @DustinB3403
        last edited by

        @DustinB3403 You'd need at least 5601 open, right? What's the output of

        fireall-cmd --list-all
        
        DustinB3403D 1 Reply Last reply Reply Quote 0
        • DustinB3403D
          DustinB3403 @travisdh1
          last edited by

          @travisdh1

          [root@syslog-cent log]# firewall-cmd --list-all
          public (default, active)
            interfaces: eth0
            sources:
            services: dhcpv6-client ssh
            ports: 80/tcp 5044/tcp
            masquerade: no
            forward-ports:
            icmp-blocks:
            rich rules:
          
          1 Reply Last reply Reply Quote 0
          • travisdh1T
            travisdh1
            last edited by

            We may be getting somewhere. You're kibana.stderr looks like you need port 5601 open.

            firewall-cmd --zone=public --add-port=5601/tcp --permanent
            

            Sidenote: I still don't like firewall-cmd. Change is hard, even for geeks.

            DustinB3403D coliverC 2 Replies Last reply Reply Quote 0
            • DustinB3403D
              DustinB3403 @travisdh1
              last edited by DustinB3403

              @travisdh1 So with both TCP and UDP open.

              [root@syslog-cent log]# firewall-cmd --list-all
              public (default, active)
                interfaces: eth0
                sources:
                services: dhcpv6-client ssh
                ports: 5601/udp 80/tcp 5601/tcp 5044/tcp
                masquerade: no
                forward-ports:
                icmp-blocks:
                rich rules:
              

              Still nothing showing up in Kibana

              1 Reply Last reply Reply Quote 0
              • coliverC
                coliver @travisdh1
                last edited by

                @travisdh1 said in SysLog Forwarding for XenServer:

                We may be getting somewhere. You're kibana.stderr looks like you need port 5601 open.

                firewall-cmd --zone=public --add-port=5601/tcp --permanent
                

                Sidenote: I still don't like firewall-cmd. Change is hard, even for geeks.

                Do you have to reload the firewalld settings to get them to apply?

                firewall-cmd --reload
                
                travisdh1T DustinB3403D 2 Replies Last reply Reply Quote 1
                • travisdh1T
                  travisdh1 @coliver
                  last edited by

                  @coliver Yep, I keep forgetting that step.... spent an hour the other day wondering why things weren't working.

                  1 Reply Last reply Reply Quote 0
                  • DustinB3403D
                    DustinB3403 @coliver
                    last edited by

                    @coliver I did.

                    I'll run it again though.

                    1 Reply Last reply Reply Quote 0
                    • DustinB3403D
                      DustinB3403
                      last edited by

                      So still digging into this...

                      [root@syslog-cent bin]# ./kibana serve restart
                        log   [10:14:12.914] [fatal] Error: listen EADDRINUSE 0.0.0.0:5601
                      	at Object.exports._errnoException (util.js:870:11)
                      	at exports._exceptionWithHostPort (util.js:893:20)
                      	at Server._listen2 (net.js:1236:14)
                      	at listen (net.js:1272:10)
                      	at net.js:1381:9
                      	at nextTickCallbackWith3Args (node.js:448:9)
                      	at process._tickDomainCallback (node.js:395:17)
                      FATAL { [Error: listen EADDRINUSE 0.0.0.0:5601]
                        cause:
                         { [Error: listen EADDRINUSE 0.0.0.0:5601]
                      	 code: 'EADDRINUSE',
                      	 errno: 'EADDRINUSE',
                      	 syscall: 'listen',
                      	 address: '0.0.0.0',
                      	 port: 5601 },
                        isOperational: true,
                        code: 'EADDRINUSE',
                        errno: 'EADDRINUSE',
                        syscall: 'listen',
                        address: '0.0.0.0',
                        port: 5601 }
                      
                      1 Reply Last reply Reply Quote 0
                      • DustinB3403D
                        DustinB3403
                        last edited by

                        We must have to change the kibana.yml file to not listen on the localhost address...

                        kibana.yml...

                        [root@syslog-cent config]# cat kibana.yml
                        server.host: "localhost"
                        elasticsearch_url: "http://localhost:9200"
                        server.port:5601
                        
                        1 Reply Last reply Reply Quote 0
                        • DustinB3403D
                          DustinB3403
                          last edited by

                          I'm rebooting see if its hung somewhere. As from what I can find online the kibana server is supposedly running twice...

                          1 Reply Last reply Reply Quote 0
                          • DustinB3403D
                            DustinB3403
                            last edited by

                            Ok so after playing with the timestamp (top right) I do actually have logs, but only from the 12th of the month...

                            So maybe it was working, but not showing the logs... now to figure out what the crap is broken....

                            1 Reply Last reply Reply Quote 1
                            • momurdaM
                              momurda
                              last edited by

                              I donwloaded the Graylog OVA this morning to test it out and put it on my XS pool. Just set Xencenter to forward logs to the Graylog server, seems to work well. Xenserver still making local log entries, but i am ok with that.
                              Xenserver sure does like logging messages. 2 hosts making a couple hundred messages/minute, xenstored and xapi are the top ones by far.

                              DustinB3403D BRRABillB 2 Replies Last reply Reply Quote 2
                              • DustinB3403D
                                DustinB3403 @momurda
                                last edited by

                                @momurda said in SysLog Forwarding for XenServer:

                                I donwloaded the Graylog OVA this morning to test it out and put it on my XS pool. Just set Xencenter to forward logs to the Graylog server, seems to work well. Xenserver still making local log entries, but i am ok with that.
                                Xenserver sure does like logging messages. 2 hosts making a couple hundred messages/minute, xenstored and xapi are the top ones by far.

                                What source are you using?

                                1 Reply Last reply Reply Quote 0
                                • momurdaM
                                  momurda
                                  last edited by

                                  All i did was download and import the ova, then went into Xencenter and forwarded logs on each host to the ip of the graylog server. Here is my sources page
                                  0_1471548705190_upload-f2c491d5-e547-43ae-bbe7-1cfaeb259539

                                  Here is more sources, basically the whole list. I am still quite overwhelmed with the options and config of graylog, but as i get dashboards setup for things and add more log sources i will post them here as well if you would like.

                                  0_1471548847262_upload-5fae783d-0560-4963-b4af-b4000cdc21b3

                                  1 Reply Last reply Reply Quote 1
                                  • momurdaM
                                    momurda
                                    last edited by

                                    I think it is important to note that the graylog ova is preconfigured to 'just work' according to their site, and it seems to do just that. I will try adding some of my windows vm to this and see what happens later today or tomorrow.

                                    BRRABillB 1 Reply Last reply Reply Quote 1
                                    • DustinB3403D
                                      DustinB3403
                                      last edited by

                                      For some reason I thought / think there are some pretty big limitations to GrayLog.

                                      Maybe I'm wrong.... but I'll take a look at it.

                                      1 Reply Last reply Reply Quote 0
                                      • DustinB3403D
                                        DustinB3403
                                        last edited by

                                        For anyone curious how to stop any local logging just modify

                                        /var/lib/syslog.conf
                                        

                                        Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                                        BRRABillB 1 Reply Last reply Reply Quote 1
                                        • BRRABillB
                                          BRRABill @DustinB3403
                                          last edited by

                                          @DustinB3403 said in SysLog Forwarding for XenServer:

                                          For anyone curious how to stop any local logging just modify

                                          /var/lib/syslog.conf
                                          

                                          Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                                          Reboot and see if it sticks.

                                          It did not for me.

                                          DustinB3403D 1 Reply Last reply Reply Quote 0
                                          • BRRABillB
                                            BRRABill @momurda
                                            last edited by

                                            @momurda said in SysLog Forwarding for XenServer:

                                            I donwloaded the Graylog OVA this morning to test it out and put it on my XS pool.

                                            I cannot get it to import onto my XS.

                                            Did you just import it in with no issues?

                                            BRRABillB momurdaM 2 Replies Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 6
                                            • 5 / 6
                                            • First post
                                              Last post