How to gather logs from a router

Elastic Stack Logstash
1

I have a Juniper router from which i have to send logs to logstash.
What should i do in this case

2

It should be able to send logs to a network based syslog destination, so use the syslog input.

3

Hi,
What is the port number should i use?

And also i'm running the logstash in a virtual box

4

Usually something over 1024, as that will be an unprivileged port, so you don't need to run as root.

5

Hi,

input {
    syslog {
            host => "10.216.131.209"
            type => "syslog"
            port => 10514
          }
    }

I set the port number to 10514 but it gives me this warning

Apr 11 15:09:29 hari-VirtualBox logstash[20457]: [2020-04-11T15:09:29,496][INFO ][logstash.inputs.syslog   ][main] Starting syslog tcp listener {:address=>"10.216.131.209:10514"}
Apr 11 15:09:29 hari-VirtualBox logstash[20457]: [2020-04-11T15:09:29,499][WARN ][logstash.inputs.syslog   ][main] syslog listener died {:protocol=>:tcp, :address=>"10.216.131.209:10514", :exception=>#<Errno::EADDRNOTAVAIL: Cannot assign requested address - bind - Cannot assign requested address>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:127:in `initialize'", "org/jruby/RubyIO.java:878:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:167:in `tcp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:130:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:114:in `block in run'"]}
6

Is that port taken already?

7

No it is not taken

8

Is that IP allocated to an interface on the host?

9

Hi,
It's the IP of the router from which i must collect logs.

I'm sorry. I'm just learning the basics of networking. So please guide me if i'm wrong.

10

No worries :slight_smile:

So the host value is the interface (IP) on the host that Logstash runs on. That is, it's the IP and port that you want to listen on. You'd then configure the router to send to that IP and port.

11

Thanks warkolm. I dont see the error now. :slight_smile:

Is it possible to configure the router to send logs to virtualbox's IP(in my case i'm running the logstash on a virtual box)

12

Most likely, you'd need to check the Juniper docs on that :slight_smile:

13

sure. thanks :slight_smile:

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.