NetXMS agent as syslog proxy/forwarder?

[normalcy]

Hi, I'm a mikrotik dude refugee and just discovered NetXMS via Tomas Kirnak's excellent videos (looking forward to more of those).

Still wrapping my head around the whole system but I am curious about the possibilities for monitoring customer sites MSP style.  The agents can be configured in zones to proxy SNMP and NetXMS agent polls and buffer them for reporting back to the main server correct?  Can the agent also act as a proxy syslog server/forwarder or can you only send syslogs back to the master server? 

My thought is that if you have one proxy per client zone with an unreliable internet connection between you could send syslogs to the local proxy and when the internet connection to the main server is re-established the syslog messages are forwarded?

Or would you need to have a host (the one running the NetXMS proxy?) at the client site to run a standard syslog forwarder independent of NetXMS agent to handle that use case?

What are people using to monitor client sites remotely? NUCs with linux?  A customer windows host configured as proxy?

Cheers.

[pheller]

+1  Hoping to use distributed NetXMS agents for store-and-forward for Syslog.

[tomaskir]

Since this post was never answered, allow me to post some details:
Currently, SNMP and NetXMS Agent proxying is fully supported. Data (Traps, collected DCIs, etc.) will be cached if the connection to the NetXMS server is down, and when the connection to the server is restored, reconciliation will happen (meaning agent will sync data back to the server).
Proxying is supported for whole zones, as well as for individual nodes (or groups of nodes) if you are not doing zoning.

Syslog proxying is however currently not supported, but from what I know, its on the ToDo list.

As for what we use for local customer proxies, Raspberry Pi's are great for that.

[jdowney]

I know this is an old post. Has Syslog proxy been implemented? Also Tomaskir what OS do you have running on your Raspberry Pi's?

Thanks

[tomaskir]

Yes, syslog proxy has been fully implemented, zone matching is properly supported, etc.

We use Raspbian Lite on our Pis.

[jdowney]

Thanks,

EnableSyslogProxy = yes

Anything wrong with this using - NetXMS agent 2.1-M2 (windows) Please see attached.

---

[tomaskir]

All proxy related settings are this:

# Proxying related settings
EnableProxy = yes
EnableSNMPProxy = yes
EnableSNMPTrapProxy = yes
EnableSyslogProxy = yes
ZoneId = 1017

You need to configure ZoneId for proper zone matching of Syslog and SNMP Traps.

[jdowney]

Thanks Tomaskir working now!

 ;D

[jdowney]

Should all agents in each zone have the Zone ID specified? Or just the machines that are being used as proxies?

Also am I correctly in thinking the proxy's cache Syslog and SNMP traps etc when a link to the master server is lost?

John

[tomaskir]

@jdowney said in NetXMS agent as syslog proxy/forwarder?:

Should all agents in each zone have the Zone ID specified? Or just the machines that are being used as proxies?

Also am I correctly in thinking the proxy's cache Syslog and SNMP traps etc when a link to the master server is lost?

John

Only the proxy needs ZoneId configured.

I am actually not sure about caching - Viktor will be the best to answer that.

[victor]

Hi,

yes, agent will cache syslog records and SNMP traps, but only in memory. If you restart agent while there is no connection, unsent records will be lost.

Best regards,
Victor

[jdowney]

Thanks, Victor that's helpful info.

[AleCoelli]

Hi Victor, this it a quite old post, but I think that agent still cache syslog records and SNMP traps only in memory.
Do you think that it will be possible to cache to disk some data  instead of memory? when we have long power outage on our customer site, we lost a lot of information about what's appened during the outage..

thanks
Alessandro

[victor]

Hi,

latest agent versions do store syslog records and SNMP traps in local database (since version 3.4).

Best regards,
Victor