Syslog Server Management

View the Configured Syslog Servers

1. In the Settings Pane, select > SERVICES > Alerting and Monitoring.
   The ALERTING AND MONITORING page displays.

2. Select the SYSLOG tab.

Add a New Syslog Server

1. In the Settings Pane, select > SERVICES > Alerting and Monitoring.
   The ALERTING AND MONITORING page displays.

2. Select the SYSLOG tab.

3. Click the New Syslog Server button.
   The CREATE NEW SYSLOG SERVER dialog displays.

4. Enter the Server Address.

5. Set the Protocol to UDP or TCP.

6. Enter the Port.

   Note: For UDP the default port is 514. For TCP the default port is 601.

7. Click Create Syslog server.

Modify a Syslog Server

1. In the Settings Pane, select > SERVICES > Alerting and Monitoring.
   The ALERTING AND MONITORING page displays.

2. Select the SYSLOG tab.

3. Locate and click the SERVER ADDRESS of the server you want to modify.
   The UPDATE dialog displays.

4. Modify the details as required.

5. Click Update Syslog server.

Delete a Syslog Server

1. In the Settings Pane, select > SERVICES > Alerting and Monitoring.
   The ALERTING AND MONITORING page displays.

2. Select the SYSLOG tab.

3. Locate and click the SERVER ADDRESS of the server you want to delete.

4. Click Delete.
   The DELETE SYSLOG SERVER confirmation dialog displays.

5. Click Delete.

Change the Syslog Template

A syslog template is a formatting rule that defines how log messages are structured when they are sent to a remote syslog server. These templates provide control over message layout, specific fields to include, and compatibility with logging infrastructure. By default, the syslog server template is set to passthrough which uses Opengear formatting for messages. Some syslog servers may require structured formats like RFC_5424 to parse messages correctly.

To change to a different template, use the set_syslog_server_template_name script:

1. SSH into Lighthouse as root or with sudo privileges.

2. Ensure that the new template name you want to use is defined in the file:

   /etc/config/rsyslog.d/remote‑syslog-template.conf.

3. Run the following command to list the remote syslog servers and their indexes:

   sudo set_syslog_server_template_name --list

4. Run the script on your Lighthouse system:

   Note: Replace <server‑index> with the index number shown from the --list command in step 2.

   sudo set_syslog_server_template_name --select <server‑index> --template RFC_5424

5. When prompted, confirm the change (y).
   The script validates the template syntax before it updates the database.
   After the update, the configurator pushes the new template to the corresponding syslog server configuration file.