-
Title
Checking the system logs of Syslog-ng Store Box -
Description
This knowledge article shows how the system logs can be accessed and checked.Several situations necessitate checking the system logs of Syslog-ng Store Box (SSB).These include:
- Configuration issues
- Archive or backup problem
- Troubleshoot report generation
- Fault in Alerting
- HA cluster issues
- WEB UI related errors
-
Resolution
Search for issues in local logs
SSB generates various log messages during its operation and stores them in the local logspace.
When you encounter an issue, you can check local logspace for specific logs or errors, which can help you to find the root cause.
Navigate to Search --> Logspaces --> Select local logspace --> add a search expression
Search expression Log results error General errors program:syslog-ng Syslog-ng logs program:ssb/backupSystem and data backup program:ssb/archive Archiving and cleanup program:ssb/reporting Reporting program:ssb/web WEB UI related logs program:ssb/logstats Statistics daemon, Message rate alert program:ssb/rpc REST API program:ssb/traptoemail
program:ssb/traptosnmpAlerting logs program:heartbeat
program:ssb/haHA cluster logs Search expressions can be combined with OR, AND, NOT operators. eg. 'program:ssb/traptoemail OR program:ssb/traptosnmp'
Troubleshooting on the fly
SSB provides an interface to view the system logs on the fly.
Similarly to the search interface you can filter the logs with a search pattern. Note that 'program:' prefix is not needed, as shown in the screenshot.
Navigate to Basic Settings --> Troubleshooting --> View log files --> optionally add a search pattern
A new window will open with continuously updated new logs.
This way, in the main window you can reproduce your issue while checking the system logs.
Debug logging
Warning!
Turning on debug logging produces a few times more system logs than standard logging.
This may affect performance and lead to message loss.
If your system's CPU and/or memory usage is above 90% do not debug logging.
Debug logs provide the most detailed information about what the appliance is doing.
If standard logs have not provided enough information turning on debug logging may be considered.
Note: Be aware that syslog-ng will not produce debug logs by default. (See next section.)
Navigate to Basic Settings --> Management --> Debug logging --> Enable debug logs
Increasing log verbosity of Syslog-ng
Warning!
Increasing log verbosity produces many times more system logs than standard logging.
This may affect performance and lead to message loss.
If your system's CPU and/or memory usage is above 70% do not increase log verbosity of syslog-ng.
Increasing log verbosity may help identify the root cause of message processing related issues.
Please refer to 'verbose' and 'debug' logging section from the following knowledge base article.
https://support.oneidentity.com/syslog-ng-premium-edition/kb/261897/troubleshooting-syslog-ng