Sending FreeNAS logs to remote log server

[statalently]

I am required to activate the 'full_audit' VFS module on my SMB shares, which will doubtless generate huge amounts of logs. So, I would like to separate this out from the other SMB/system logs and get it onto a separate server with plenty of space dedicated to it. Having researched and tested a little, it seems I need to make an rsyslog server on my network and have the FreeNAS send its logs there. I believe I have to edit some conf files on the FreeNAS in order to do this, but have read that anything not done in the web GUI is reset on updates/restarts. So, will it be possible to set this up? What is the proper way to maintain configuration not done in the web GUI?

Thank you for your help.

 

[dlavigne]

There is UI support if the remote server understands syslog format: https://www.ixsystems.com/documentation/freenas/11.2-U6/system.html#general.

 

[statalently]

Aha. Whoops, should have seen that. However, I notice in the tooltip that the logs continue to write to the console (/var/messages, right?) - is there any way to stop this? VFS full_audit will generate a lot of logs...
Thanks for the help!

 

[dlavigne]

Unfortunately, no. If you decide to make a feature request at bugs.ixsystems.com, post the issue number here.

 

[statalently]

Okay thanks for the tip - I have made a feature request.
https://jira.ixsystems.com/browse/NAS-103914
Keep up the good work!

 

[Hjrr]

Guys, what about sending syslog info to multiple remote syslog servers, can I do that with a comma separating the destination IPs? (Spunk & vRealize Log Insight servers)

SYSTEM-> General
syslog server: 10.0.1.79:514,10.0.1.80:514
(I am running 9.3-stable on this box.)
Seems like when I added this second destination, the log forwarding to 10.0.1.79 stopped.

 

[cinemafunk]

Guys, what about sending syslog info to multiple remote syslog servers, can I do that with a comma separating the destination IPs? (Spunk & vRealize Log Insight servers)

SYSTEM-> General
syslog server: 10.0.1.79:514,10.0.1.80:514
(I am running 9.3-stable on this box.)
Seems like when I added this second destination, the log forwarding to 10.0.1.79 stopped.

I too would like a second log destination option. I think it's worth it for a feature request.

 

[eborduas]

Okay thanks for the tip - I have made a feature request.
https://jira.ixsystems.com/browse/NAS-103914
Keep up the good work!

I voted for the feature request and added a comment.