Configuring Secondary Syslog Servers

In addition to (or instead of) configuring a "primary" syslog server (see Configuring the Primary Syslog Server Address), you can use the Syslog Servers table to configure up to four "secondary" syslog servers to where you want the device to send syslog messages. The device sends the syslog messages to all configured servers ("primary" and "secondary").

You can also configure the device's embedded syslog (Rsyslog) client to send event logs (syslog messages) to Apache Kafka, an open-source platform for event streaming. As a Kafka producer, the device transmits syslog messages to the remote Kafka broker. The broker can be on a local server or hosted on the cloud.

The Kafka broker manages one or more topics, which act like categories for classifying syslog messages. Multiple applications or services (Kafka consumers) can subscribe to these topics and receive the syslog messages. When multiple Kafka topics exist, you would need to configure multiple Kafka-based syslog servers with the same address for the Kafka broker in the Syslog Servers table. However, each syslog server would be configured with a different Kafka topic name, and different information type and / or severity level.

● To enable the device to send syslog messages, you MUST also configure the 'VoIP Debug Level' parameter to Basic or Detailed (see Configuring Syslog Debug Level).
● The syslog servers are also used as CDR servers, unless you configure a dedicated CDR server address as described in Enabling CDR Generation and Configuring the CDR Server Address.
● Configuring duplicated secondary syslog servers with the same address and port is invalid.
● Configuring duplicated secondary syslog servers with the same address and port as the primary syslog server is invalid.
● The syslog sequence number resets if the device restarts.

The following procedure describes how to configure secondary syslog servers through the Web interface. You can also configure it through ini file [SyslogServers] or CLI (configure troubleshoot > syslog > syslog-servers).

➢ To configure secondary syslog servers:
1. Open the Syslog Servers table (Troubleshoot menu > Logging folder > Syslog Servers).
2. Click New; the following dialog box appears:

3. Configure a secondary syslog server according to the parameters described in the table below.
4. Click Apply.

Syslog Servers Parameter Descriptions

Parameter

Description

'Index'

Defines an index number for the new table row.

Note: Each row must be configured with a unique index.

'Address '

ip-address

[Address]

Defines the address of the syslog server.

The valid value depends on the type of syslog server:

■ Regular syslog server: IP address (IPv4 or IPv6) or an FQDN.
■ Kafka broker: FQDN of the Kafka broker name. When the Kafka broker is hosted on Microsoft Azure, the FQDN is the namespace of the Event Hub.

The default is 0.0.0.0.

'Kafka Topic'

kafka-topic-name

[Topic]

Defines the Kafka topic name.

When the Kafka broker is hosted on Microsoft Azure, the topic name is the Event Hub namespace.

By default, no value is defined.

Note: The parameter is applicable only when the syslog server is a Kafka broker.

'Kafka Connection String'

kafka-connection-string

[ConnectionString]

Defines the authentication string (password) for connecting to the Kafka broker (topic). When configured, the device encrypts the syslog messages.

The figure below shows where you can copy the connection string from for the Kafka broker's topic in Azure Event Hubs:

By default, no value is defined, which means that Kafka communication is over TCP.

Note:

■ The parameter is applicable only when the syslog server is a Kafka broker.
■ The parameter is mandatory if the Kafka broker is hosted on Microsoft Azure (Event Hub).
■ If you configure the parameter, you must also select a TLS Context (using the 'Syslog TLS Context' parameter, as described in Configuring the Primary Syslog Server Address).

'Port'

port

[Port]

Defines the syslog server's port number.

The default is 514.

Note: When the Kafka broker is hosted on Microsoft Azure, configure the port to 9093.

'Transport Protocol'

protocol

[Protocol]

Defines the transport protocol for communicating with the syslog server.

■ [0] UDP (default)
■ [1] TCP
■ [2] TLS
■ [3] Kafka

Note: You also need to select a TLS Context (using the 'Syslog TLS Context' parameter, as described in Configuring the Primary Syslog Server Address) for the following settings:

■ If you configure the parameter to TLS.
■ If you configure the parameter to Kafka and you configure a value for the 'Kafka Connection String' parameter.

'Interface'

interface

[Interface]

Assigns an IP Interface from the IP Interfaces table (see Configuring IP Network Interfaces) for communication with the syslog server.

By default, no value is defined, which means that the device uses the IPv4 OAMP network interface.

Note: The address version (IPv4 or IPv6) of the IP Interface and the syslog server's address (see 'Address' parameter above) must be the same.

'Information Type'

info-type

[InfoType]

Defines the type of information that the device sends in syslog messages to the remote syslog server.

■ [0] All = (Default) Sends all below options.
■ [1] CDR = Sends only CDRs.
■ [2] SDR = Sends only SDRs.
■ [3] Syslog = Sends only syslogs.

'Severity Level'

severity-level

[SeverityLevel]

Defines the minimum severity level of messages included in the syslog message that the device sends to the syslog server.

The severity levels in the list below are in descending order (from highest to lowest). Only the selected severity level and all higher severity levels are included in syslog messages. For example, if you configure the parameter to Alert, the syslog includes only alert ("alert") and emergency ("emerg") messages.

■ [0] Emergency
■ [1] Alert
■ [2] Critical
■ [3] Error
■ [4] Warning
■ [5] Notice (default)
■ [6] Info [not recommended]
■ [7] Debug [not recommended]

Note:

■ It's recommended to leave the syslog severity level at default (i.e., Notice) to prevent excessive utilization of the device's resources. Changing severity level is typically done only by AudioCodes Support for debugging.
■ Upon a device restart or HA switchover, the parameter restores to default (i.e., Notice).
■ To view the corresponding strings used in syslog messages for indicating severity levels, see Configuring Syslog Message Severity Level.

'Mode'

mode

[Mode]

Activates or deactivates the syslog server.

■ [0] Disable = (Default) The device doesn't send syslog messages to the configured syslog server.
■ [1] Enable = The device sends syslog messages to the configured syslog server.