[Solved] Problems Getting Remote Logging Working

[mikeyjoel]

Hi, OpenWRT Community!
I've been trying to get my OpenWrt device to forward logs to my Splunk Dev Licensed container instance with port 514 opened for a few hours now. I tested working via 514/tcp with a Synology with no issues.

Now, when trying to do the same with OpenWrt, I'm not getting any logs forwarded.
Followed the following two resources:
https://openwrt.org/docs/guide-user/base-system/system_configuration
https://openwrt.org/docs/guide-user/base-system/log.essentials

Did find a few other topics going back to 2020 with little information.

Router Information:
Model: Netgear Nighthawk X4S R7800
Architecture: ARMv7 Processor rev 0 (v7l)
Target Platform: ipq806x/generic
Firmware Version: OpenWrt 23.05.0 r23497-6637af95aa / LuCI openwrt-23.05 branch git-24.006.68745-9128656
Kernel Version: 5.15.134

Appended the following to /etc/config/system:

config system
        option log_ip '192.168.1.24'
        option log_port '514'
        option log_proto 'tcp'

Appended the following to /etc/config/firewall:

config rule
        option target 'ACCEPT'
        option dest 'lan'
        option dest_port '514'
        option name 'ACCEPT-LOG-DEVICE-LAN'
        list dest_ip '192.168.1.24'
        list proto 'tcp'

In Summary, I want my OpenWrt router to forward logs via port 514/tcp for it to be indexed by either Splunk, Wazuh, ELK, etc. This way, I can create nice queries and alert myself of incidents.

I appreciate any help you can provide.

[psherman]

Syslog generally runs on udp port 514. You’ve your your rules set for tcp.

The firewall rule is not necessary less your lan has firewall restrictions that you have added.

Make sure the host at 192.168.1.24 is has a running syslog server. It will be udp unless you have changed the default on the syslog server config.

[mikeyjoel]

Hi @psherman ! Thanks for the quick reply.
I will go ahead and setup the data input to be received on 514/udp instead of tcp for testing purposes and go ahead and setup a dedicated syslog-ng for testing purposes.

But syslog generally does work on tcp to encrypt traffic especially for digesting to a cloud SIEM for example.

Could it be that OpenWrt requires additional configuration or dependencies to have tcp enabled ?

Noticed that 6514 might be used for tcp encrypted connections but let me first do as you suggested to have a regular syslog server receiving on udp 514 to make sure there are no issues with the OpenWrt device. Will get back with additional information.

[psherman]

@mikeyjoel

But syslog generally does work on tcp to encrypt traffic especially for digesting to a cloud SIEM for example.

Sure, syslog can be configured to use TCP.... but by default will use udp.

@mikeyjoel

Could it be that OpenWrt requires additional configuration or dependencies to have tcp enabled ?

Maybe... honestly, I don't know -- I use syslog via udp.

If you're adding encryption to the mix, that would almost certainly require other changes to OpenWrt's default logging method.

Given that you're working on a local network (based on the RFC1918 address of your syslog server), there usually isn't a need to use TCP or encryption.

[mikeyjoel]

Thanks, @psherman, it's working when setting the data inputs on Splunk with 514/udp.

Note* that I had to configure the docker-compose.yml with - 514:514/udp and make sure to create a firewall-cmd rich rule for 514/udp as well on the rhel box I'm using.

The main reason for setting up TCP is to have a DR (Disaster Recovery) just in case anything happens for it to be automatically forwarded to Splunk Cloud as a fail back and we don't want that to be unencrypted coming out of the OpenWRT device if that were to happen.

I'll go ahead and now test with TCP on port 6514 and update with any findings.

[psherman]

@mikeyjoel

Thanks, @psherman, it's working when setting the data inputs on Splunk with 514/udp.

Great!

@mikeyjoel

The main reason for setting up TCP is to have a DR (Disaster Recovery) just in case anything happens for it to be automatically forwarded to Splunk Cloud as a fail back

Makes sense. The documentation suggests that OpenWrt supports TCP syslog out of the box, but I've never tried it.

As far as encryption -- my guess (and I could be wrong) is that this is not supported by OpenWrt as standard. You may have to install some packages and/or build from source so you can enable any relevant options.

Anyway, we now know that your general syslog is working as expected via UDP... if you want to hold this thread open for a resolution on TCP and/or encryption, feel free to do so. But...

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks!

[mikeyjoel]

Sounds Good! Tested manually logging and all perfect via udp. Super grateful with all the help!

logger -p err -t openwrt_splunk "Thanks Peter!"