FireBrick FB6402, Руководство пользователя

Страница: 47 / 196

Event Logging
30
5.1.1.2. Logging to the Console
The console is the command line environment described in Chapter 16. You can cause log entries to be displayed
as soon as possible on the console (assuming an active console session) by setting
console="true"
on
the log target.
You can stop the console logging with troff command or restart it with tron command.
The FB6000 also has a serial console to which console log entries are sent if logged in.
5.2. Enabling logging
Event logging is enabled by setting one of the attributes shown in Table 5.1 on the appropriate object(s) in the
configuration, which depends on what event(s) you are interested in. The attribute value specifies the name
of the log target to send the event message to. The events that cause a log entry will naturally depend on the
object on which you enable logging. Some objects have additional attributes such as
log-error
for unusual
events, and
log-debug
for extra detail.
Table 5.1. Logging attributes
Attribute Event types
log
This is normal events. Note that if
log-error
is not
set then this includes errors.
log-error
This is when things happen that should not. It could be
something as simple as bad login on telnet. Note that
if
log-error
is not set but
log
is set then errors are
logged to the log target by default.
log-debug
This is extra detail and is normally only used when
diagnosing a problem. Debug logging can be a lot of
information, for example, in some cases whole packets
are logged (e.g. PPP). It is generally best only to use
debug logging when needed.
5.3. Logging to external destinations
Entries in the buffer can also be sent on to external destinations, such as via email or syslog. Support for
triggering SNMP traps may be provided in a future software release.
You can set these differently for each log target. There is inevitably a slight lag between the event happening
and the log message being sent on, and in some cases, such as email, you can deliberately delay the sending
of logs to avoid getting an excessive number of emails.
If an external logging system cannot keep up with the rate logs are generated then log entries can be lost. The
fastest type of external logging is using syslog which should manage to keep up in pretty much all cases.
5.3.1. Syslog
The FB6000 supports sending of log entries across a network to a syslog server. Syslog is described in RFC5424
[http://tools.ietf.org/html/rfc5424], and the FB6000 includes microsecond resolution time stamps, the hostname
(from system settings) and a module name in entries sent via syslog. Syslog logging is very quick as there
is no reply, and syslog servers can be easily setup on most operating systems, particularly Unix-like systems
such as Linux.
Note
Older syslog servers will typically show time and hostname twice, and will need upgrading.