Remote SYSLOG

What is Remote Syslog?

With an organically growing network, the number of devices that create locally stored log files grows. Since each device follows his own method to provide local log file data, it is a big problem to collect and centralize these data for network error analyzes. Remote Syslog follows the idea that as many systems as possible not only manage their log files locally, but also store them in a standardized data format on a central syslog server:

By doing so, higher level management systems are able to automatically access the files, search for problems and errors within a network and, if necessary, to initiate appropriate measures.

Rsyslog configuration inside the CS141

For this configuration step, you need the following menus:

Rsyslog does not work “out of the box” - some configuration work is required. To do this, open the menu services and click on Setup to start the initial configuration:

To make the basic settings, click on "RSyslog" under Services. You can define up to two different Syslog receivers by clicking "+":

The configuration dialogue:

The menues explaind in detail

Remote syslog server IP

With Remote Syslog, the CS141 sends its status messages from the event log file in real time directly to an IP address, where an RSyslog server receives the information and distributes it accordingly on its hard drive. Please note that you cannot define directories or "network drives". For the valid IP address please refer to the local network administrator.

Remote syslog server port

In addition to the IP address, a remote syslog server normally uses a predefined port to receive status logs. The default port for rsyslog is 601. Since this is not an official standard port for rsyslog, the port used by the server may differ. If necessary, consult the local administrator and adjust the port setting according to the network requirements.

Accept only TLS connection / Reject expired TLS certificates

The CS141 can be advised to use encrypted communication only. If checked, the CS141 will reject expired certificates for communication. These functions are only available if you have imported a valid certificate. Please note that with the use of TLS encryption, further configuration on the corresponding syslog server is necessary.

Note:

The options "Accept TLS connections only" and "Reject expired certificates" are explicitly enabled as soon as a corresponding syslog certificate has been uploaded.

About the use of SYSLOG

What is the basic idea behind remote syslog?

Anyone who has to manage large networks will quickly realize that, especially in the event of a fault, many networked devices generate numerous log files — often revealing valuable information about the cause and course of a network issue. However, when analyzing this data, several challenges commonly arise:

• Organically grown network structures include a wide variety of different network devices.

• Log files are not standardized; each manufacturer uses its own format.

• The local storage space of network devices is limited, leading to various consequences.

• Depending on the manufacturer, analysis tools may be available, but these are usually limited to the vendor’s own products.

• Many devices require individual passwords, and in the worst case, these must be entered one by one, since RADIUS functions are either not implemented or a RADIUS server is unavailable due to the network failure.

This list can be extended indefinitely, but in short:
In such cases, data evaluation takes unnecessarily long, and most of the time is spent just collecting and preparing the data — for example, copying from a custom tool, downloading and opening local log files, and manually entering them into a database.

The solution here is "remote syslog", a function that a professional device like the CS141 should naturally support.

The idea is that locally stored log files are also transmitted in a standardized format to a central data log collector — the so-called syslog server. The syslog server simply receives this data and makes it available to third-party diagnostic software, which then decides what actions to take after automatic evaluation.

What do I achieve with that?

In addition to saving a great deal of time otherwise spent collecting data for evaluation, you gain access to virtually unlimited storage capacity. All devices in the CS141 product family offer ample space for storing system events locally. When this memory is full, the oldest entry is deleted to make room for the newest one.

With Syslog, however, you can transmit status messages directly to an external server, allowing you to collect uninterrupted event chains over an almost unlimited period.

Why is there no CS141 syslog list of events that will be transmitted?

Providing such a list would be very difficult, as the CS141 supports more than 1,000 UPS models from nearly all manufacturers on the market and, depending on the model, can also include additional building management functions. Many manufacturers and suppliers now use their own terminology for "their" specific functions, so there are no standardized entries available.

Therefore, the CS141 uses its own event log as a blueprint: as soon as you activate remote syslog, everything recorded in the local event log is automatically forwarded to a syslog server as a system status—almost in real time. If the syslog server is not available, this is logged locally on the CS141.

In this way, you will never lose a system status message again.

Why is it “almost“ real time?

If an internal operating system service creates an entry in the event log, the CS141's syslog service attempts to send it once to a central collector.
If this is not possible—e.g., due to a malfunction preventing access to the central collector—the entry is stored locally but not retransmitted.
Instead, a note is added to the event log for this period indicating a malfunction.

Is it possible to edit the log entries to create a general log file structure for my diagnostic programs?

Yes, all log entries that are based on system events can be customized by adding or editing the job "Log".
For example, open the "Power Failure" event and modify the "Log" job to match your syslog search term.

If, as shown in the example on the right, you change the "Log" job so that "syslog_USV_15" appears first, then exactly that text will also be transmitted to the syslog server—because it is written to the local event log at the moment of execution.

What text you use is entirely up to you.
In this way, you can also assign jobs to any available analog or digital inputs and provide a unique diagnosis code to easily locate and identify the corresponding error messages later.
The CS141 will follow your specifications exactly:

Whatever is written in the event log will be transmitted exactly as it is.