Syslog-NG Installation

The Syslog-NG, or System Log Next-Generation, service is an updated version of the default Syslog service found on FreeBSD and other UNIX and Unix-like systems (a paid-for version exists for Microsoft operating systems). Enhancements include the ability to filter content, various methods of storing information including separate files-per-device or MySQL databases and, a key feature, the addition of TCP for transportation of events (typically UDP is used on basic Syslog services).

The source code for Syslog-NG was used to create a commercial product maintained by | Balabit under the name Syslog-NG Premium Edition. This is a paid-for-support version of the free Syslog-NG code and revenue from it is used to fund development of the free edition.

Purpose

For further information on the default Syslog service installed on FreeBSD see the main Syslog article. The following is an explanation of the purpose of Syslog-NG specifically.

The purpose of installing and utilising Syslog-NG becomes apparent when you begin to monitor Syslog events from multiple servers (and other network-attached Syslog-capable devices) and require a centralised method in which to do so. Furthermore the ability to easily track, view and manage Syslog events are important. The enhancements made to Syslog-NG permit this functionality.

Examples

There are a number of reasons why upgrading to Syslog-NG is beneficial:

• a data-centre that houses numerous network devices all capable of sending Syslog event notifications;
• a medium-to-large organisation that has a wide-spread presence in different locations;
• fault detection of unmanned systems;
• other Syslog-capable devices that may not have simplified means to view events.

They all run along similar lines and many medium and larger organisations may benefit from utilising Syslog-NG somewhere on the corporate network.

Installation

The following is a guide to installing (or upgrading to) Syslog-NG on FreeBSD using the MySQL functionality. It also covers the installation and configuration of PHP-Syslog-NG. This is a web-based utility, essentially a set of PHP-based scripts for use within Apache to enable browser access to the Syslog-NG stored events.

Pre-requisites

For reference the following was undertaken by the author on a HP ML570 G2 server using FreeBSD 7.0. The particular release of FreeBSD should not matter too much. In addition the author selected Apache 2.2, MySQL 5.x and PHP 5.x and assigned a second (RAID5) drive entirely to an '/svr' volume (all regular FreeBSD volumes were allocated on the first (RAID1) drive).

For guidance on installing FreeBSD review this article. It is highly recommended, if using MySQL, to allocate either a larger than normal '/var' volume or create a separate volume to store the MySQL database in - for example a secondary drive allocated as '/svr'.

This installation guide will require the following ports to be installed:

• Apache - a full-featured web server, but any PHP-compatible web service should be acceptable;
• MySQL-Server - a full-featured database server;
• PHP - a popular scripting language used of web servers;
• Syslog-NG - the updated Syslog service.

Ensure that the MySQL dependency is selected under the PHP port options page. The options page is displayed when running make from the ports system. This will install the 'mysql-client' automatically (not to be mistaken with the 'mysql-server' port).

It is recommended that the NTP service is configured to ensure accurate time is maintained against logged events.

Configuration

As with all services that run on FreeBSD they must first be enabled within the rc.conf file. Add the following lines as appropriate:

syslogd_enable="NO"
syslog_ng_enable="YES"
syslogd_program="/usr/local/sbin/syslog-ng"
syslogd_flags=""
mysql_enable="YES"
apache22_enable="YES"
syslog_pipe_enable="YES"

The 'syslog_pipe' entry is a script that is required if using the MySQL functionality and is therefore not part of the other 'syslog' entries.

If utilising a larger, separate volume for the MySQL database store the following should be done:

# /usr/local/etc/rc.d/mysql-server stop
# cd /var/db
# mv mysql /svr
# ln -s /svr/mysql mysql

This has the effect of moving the physical 'mysql' database store from the default '/var' volume to the larger '/svr' volume and then creates a symbolic link to the original location. This 'trick' allows MySQL to function without needing to re-configure all of its data store locations individually. For more information on the concepts of symbolic links review this article.

If the MySQL directory does not exist first enable it (see above 'rc.conf' entries) and start MySQL as follows:

# /usr/local/etc/rc.d/mysql-server start

This will create the directory as part of the initial loading phase.