Syslog

Syslog Overview

The syslog protocol is a standard for logging program messages to a database. It is commonly used to monitor devices that do not have a large amount of storage capacity, such as networking devices, ESX servers, PCoIP Zero Clients, and PCoIP Remote Workstation Cards. Using syslog for logging allows you to centralize the storage of log messages and to capture and maintain a longer history of log data. It also provides a set of tools to filter and report on syslog data.

Syslog messages include a facility level (from decimal 0 to 23) that indicates the application or operating system component that is generating the log message. For example, a facility level of "0" indicates a kernel message, a facility level of "1" indicates a user-level message, and a facility level of "2" indicates a message from a mail system. Processes and daemons that have not been explicitly assigned a facility may use any of the eight "local use" facilities ("16 – local use 0" to "23 – local use 7") or they may use the "1 – user-level" facility. Facilities allow for easy filtering of messages generated by a device.

Syslog messages are also assigned a severity level from 0 to 7, where a severity level of "0" indicates an emergency panic condition and a severity level of "7" indicates a debug-level message useful to developers but not for operations.

Configuring Syslog Settings

You can configure syslog settings for a host or PCoIP Zero Client from the device's AWI, or you can use the Management Console to configure settings for a device profile. Both methods are shown below. Configuration involves entering the IP address or fully qualified domain name (FQDN) for the syslog server, and then specifying the port number and facility to use when sending messages to the syslog server.

Teradici uses UDP to send syslog messages to a centralized syslog server. Because most servers use port 514 for incoming messages, Teradici recommends you configure port 514 (the default) as the syslog port to use. However, you can use a different port as long as the syslog server is set to receive syslog messages on the same port as the device is set to send them.

Teradici also uses "19 – local use 3" as the default facility under the assumption that this facility is not commonly used. If it is being used, you can select a different facility.

Additional Devices

Cisco IOS devices, CatOS switches, and VPN 3000 concentrators use the “23 – local use 7” facility. Cisco PIX firewalls use the “20 – local use 4” facility.

Log Messages

Ensure that your syslog server can handle the volume of messages sent by a PCoIP Zero Client. With some free syslog servers, messages can become lost if the volume is too great.

Setting up Syslog from the AWI

Syslog settings in the AWI are located in the Event Log page. To configure syslog settings from the AWI for a single device:

  1. From an Internet browser, enter the IP address of the PCoIP Zero Client or host.

  2. Select the Diagnostics > Event Log menu to display the Event Log page.

  3. Check Enable Syslog, and then select whether you want to identify the syslog server by its IP address or fully qualified domain name (FQDN).

  4. Enter the IP address or FQDN of the syslog server.

  5. If the syslog server is configured to receive data on a port other than 514, enter this port number.

  6. If you wish the device to use a facility other than the default, select it from the Syslog Facility drop-down list.

  7. Click Apply.

  8. At the Success page, click Continue.

Setting up Syslog from the Management Console

Syslog settings in the Management Console are located in the Management Console's Profiles page. To configure syslog settings from the Management Console for a device profile:

  1. From an Internet browser, enter the IP address of the Management Console.

  2. Select PROFILE.

  3. Add or edit the appropriate host/client profile.

  4. Select the LOGGING link on the left.

  5. Enter the required syslog settings.

  6. Click Save.

Entered Values

You must enter a value in both the Syslog Server Port and Syslog Facility Number fields.