Syslog Overview

Description

Syslog (syslogd) is a standard for forwarding log messages to a system, often over an IP network. The term "syslog" refers to the syslog protocol, which sends a small message to a syslog daemon (syslogd) using User Datagram Protocol (UDP), Transmission Control Protocol (TCP), or Transport Layer Security (TLS) in clear text. Syslog can be used for managing computer systems and security auditing servers and applications. It is supported by a wide variety of devices and platforms.

Purpose

The most common method of providing feedback to system administrators of switches is via the Syslog mechanism. Syslog is defined in RFC3164 and updated by RFC5424. Syslog allows xNIX-type systems to emit syslog messages to a syslog server. The syslog server typically consolidates events from multiple systems and also allows for the filtering and sorting of syslog messages. Syslog messages can be used to recognize issues with equipment and to post analysis and debugging of system issues.

Service providers use "syslog" to collect, report and take action on data and events that network elements (NEs) detect. This helps service providers in a few areas. The first is proactive monitoring of user activity that affects the configuration of the element. As users make changes that affect the provisioning of data within the Optical Line Terminal (OLT) and Optical Network Terminal (ONT), events are sent to a syslog server. This allows the higher-level Operating System Service (OSS) to track user changes.

Another use of syslog is for tracking security-related events. Presently, the Panorama PON EMS supports a centralized syslog facility. This new feature consists of adding a syslog facility to the OLT. The OLT tracks security events associated with user authentication and provisioning changes. It also allows administrators to designate where and how the monitored data will be reported.

Syslog utilizes User Datagram Protocol (UDP) as its underlying transport layer mechanism. The UDP port that has been assigned to syslog is 0514. It is recommended that the source port also be 0514 to indicate that the message is from the syslog process of the sender. If the sender uses a source port other than 0514, then it is recommended, and has been considered to be good form, that subsequent messages are from a single consistent port.

A syslog command is also available through the CLI User Interface/BOLT CLI Manual (refer to the CLI User Interface Guide or the BOLT CLI Manual) to the OLT and provides, as a minimum:

• Existing information logged in event and alarm logs
• Security events, including login, logout etc.
• All provisioning changes from Web, EMS, and GUI including source and user
• All new events created going forward
   

Syslog consists of a number of components:

• An “Originator” generates syslog content to be carried in a message.
• A “Collector” gathers syslog content for further analysis.

Syslog is an unacknowledged protocol and, therefore, if some assurance of delivery is required, then TCP or TLS must be used as the transport protocol. If either Transmission Control Protocol (TCP) or Transport Layer Security (TLS) protocols are utilized for syslog, the recommended port to be used is 6514.

Refer to the following Requests for Comment (RFCs) for specific details on the syslog protocol and the transmission of syslog messages over the supported protocols:

• RFC5424 – syslog Protocol
• RFC5426 – Transmission of Syslog Messages over UDP
• RFC6587 – Transmission of Syslog Messages over TCP
• RFC5425 – Transmission of Syslog Messages over TLS

Syslog Daemon Configuration File

The syslog daemon (syslogd) processing is controlled by a configuration file called /etc/syslog.conf in which logging rules and output destinations for error messages, authorization violation messages, and trace data are defined. Logging rules are defined by using a facility name and a severity level. The facility name and severity level are passed on the logging request from an application when it wants to log a message.

Facility Name

Facility names are used to specify what type of program or software is logging the message. This lets the configuration file specify that messages from different facilities are handled differently. The list of facilities is:

The mapping between Facility Number and Keyword is not uniform over different operating systems and different syslog implementations. For cron, either 9 or 15, or both may be used. The confusion is even greater regarding auth/authpriv. 4 and 10 are most common, but 13 and 14 may also be used.

Severity Levels

There are eight security levels defined, consisting of:

In the Tellabs implementation of syslog, the following mapping occurs for alarms reported to the OLT:

Classes

There are thirteen classes defined. They are:

Reporting Requirements

The reportable Syslog Events and the methodology of reporting those events is discussed in the following sections. At a minimum, the following events are logged.

• Login / Logout Events – Security Events
• Failed Login Attempts – Security Events
• Port State Change Events – Network interface failures
• Craft Provisioning Command Events – Log the content of all craft commands and the user that issued the command (Refer to the Tellabs 1100
• Alarm Events – Show alarm set/clear events
• Failed Processes – Kernel events where processes are going down
• Card Reset Commands – A user-initiated card reset event
• Restart Events – System restarts
• Protection Events – ESU, TDU, or PON protection events
• Exception Log Entries - Exception log entry events
• Authentication Fail Events for 802.1x
• Spanning Tree Topology Events
• Spanning Tree Root Violations

Syslog Message Format

Syslog message consists of the following fields.