How to enable syslogd to receive UDP logs from routers in OSX

Question

Occasionally a router goes bad and I would like to get the router logs.

While some routers have built-in log viewers, some do not. Most routers seem to have a facility to send logs to another host using syslog.

How do I get OSX (client) to receive these logs? OSX has a syslogd, but the instructions are opaque at best.

Perhaps a different client application would be better, but I'd prefer a way I could just hack up without downloading tools across the internet that has just broken down...

OSX does not have netcat, natively, otherwise I would have tried that.

Answer 1

Using syslog-ng which is probably available for OS X, although I am not certain, I capture syslog messages over my home network from my wifi router to my log server with the following 3 lines:

 source net { udp(); };

 destination wifirouter { file("/opt/var/log/wifirouter.log"); };

 log { source(net); destination(wifirouter); };

The wifi router was then configured to use use the log server's IP address and the wifirouter identifier. You could modify the source line to accept from only certain source IP addresses.

Answer 2

The required "magic", with the stock Mac OS syslogd, is as follows.

Edit the launchd config for syslogd, /System/Library/LaunchDaemons/com.apple.syslogd.plist (you will need to be root, or use 'sudo vi' or your favourite other method to edit this.)

(Some versions seem to already have the necessary section commented out, but one of mine didn't.)

After the following:

 <key>Sockets</key>
 <dict>
 ...
     <key>BSDSystemLogger</key>
     <dict>
     ...
     </dict>

add in, or uncomment (remove the leading "" lines), this section:

     <key>NetworkListener</key>
     <dict>
          <key>SockServiceName</key>
          <string>syslog</string>
          <key>SockType</key>
          <string>dgram</string>
     </dict>

and then restart the syslogd completely (i.e. using launchctl, again as root)

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

(I think this question/ answer probably belongs on superuser.com? Maybe someone can move it over.)