OS X Lion as a syslog server
This article explains how to use MacOS X Lion (possibly earlier versions) as a syslog server for RouterOS.
First, prep the built in syslog daemon to add a listener on the network - by default it only listens on sockets. Full article is here.
sudo cp /System/Library/LaunchDaemons/com.apple.syslogd.plist /tmp/com.apple.syslogd.plist sudo plutil -convert xml1 /System/Library/LaunchDaemons/com.apple.syslogd.plist sudo vim /System/Library/LaunchDaemons/com.apple.syslogd.plistAdd this to the "Sockets" section:
<key>NetworkListener</key> <dict> <key>SockServiceName</key> <string>syslog</string> <key>SockType</key> <string>dgram</string> </dict>
OS X can use normal log files like any BSD, but it also comes with a built in data store for log messages. More info can be found at here. Data stores are fast, log rotation comes built in, and they are indexed and quickly searchable. I like my network syslog files routed to a different data store. Data store routing is configured in /etc/asl.log. Filtering can be done on a number of fields, the simplest one is "Host", which will be the router name taken from "/system identity". The "Sender" field is taken from the prefix configured under "/system logging" for the topic. I store my network syslog messages in /var/log/network in data stores named by date in /var/log/network. The directory has to exist, the below creates it with read access for everyone on a directory level (everyone can list files):
sudo mkdir /var/log/network sudo chown root:staff /var/log/network sudo chmod 0755 /var/log/network
The below routes all messages from hosts that start with "rb" in their host name in the directory created above. The UID for the files will the root, the GID will be 20, which matches the 'staff' group that all users are by default a member of. This will let anyone search network log files, adjust the UID and GID as required if you need tighter security. The below line is added to /etc/asl.conf to achieve this.
sudo vim /etc/asl.conf
? [A= Host rb] store_directory /var/log/network uid=0 gid=20 mode=0644
And finally restart the syslog daemon to have all the changes take effect.
sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plistp
Then configure the routers to log to the IP address of the OS X machine, below an example. Note that in 5.x the src-address must be set, this is best set to a loopback address (loopbacks are emulated by creating an empty bridge without any ports assigned to it, and configuring an IP address on that bridge interface)
/system logging action set remote bsd-syslog=yes name=remote remote=220.127.116.11 remote-port=514 \ src-address=18.104.22.168 syslog-facility=local7 syslog-severity=auto target=remote /system logging add action=remote disabled=no prefix=rb433 topics=system,info add action=remote disabled=no prefix=rb433 topics=warning add action=remote disabled=no prefix=rb433 topics=critical add action=remote disabled=no prefix=rb433 topics=error,!ospf,!route
On the OS X server you can then display all log messages via the syslog command, see the man page for syslog for details.