Sending syslog messages to a mac

(very old draft)

I have a router that is playing-up. It locks-up about once per day. The router is a DG834GV (v1). I recently changed ISPs and the router started to lock-up - it could just be a coincidence. My new ISP resells Telstra's ADSL(1) service so the DSLAM and probably the port are unchanged. Anyway, I thought it might be nice to see if there are any syslog messages being sent just before the router locks-up. I have a mac that runs OS-X (currently 10.5.5) that has a syslog server. So I thought I could use it to capture the syslog messages. The computer said no. The apple default configuration only logs local syslog messages. A quick google search showed that other people have re-configured it to work so I followed some instructions (which I have modified) I found here:

To enable your Leopard system to receive network syslog messages edit: /System/Library/LaunchDaemons/com.apple.syslogd.plist Open the Terminal application found in Applications/Utilities. Type sudo nano /System/Library/LaunchDaemons/com.apple.syslogd.plist Find this comment: "Un-comment the following lines to enable the network syslog protocol listener". If you can not find this comment, see my note below on my upgraded Tiger system. Change the next <!-- into <!-- --> and the following --> into <!-- -->. Now save the file by holding down the control key and pressing o to write-out the file and then you can hold control and press x to exit the editor. To enable these changes you need to restart the syslog server: sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist That should allow your external device to dump it’s log into the system log. In my case I also needed to enable syslog packets through my manually configured firewall so I executed the following command: sudo ipfw add 5 allow log udp from any to any syslog in Note: This would need to be re-entered after a re-boot. I can now see syslog messages from my router being logged to my mac using the Console application found in Applications/Utilities. Here is an example of a syslog message from my router: 12/01/09 1:33:55 AM IP address is the same, and does not need to be updated! Testing From a terminal you can issue the following command to send a syslog message to your logger:

syslog -s -r yourMacsName.local "some message" or you can use the IP address of your mac: syslog -s -r 10.0.0.1 "some message" See the man page for syslog for a full description of the message format. Upgraded Tiger Systems I also have a PowerBook G4 that has been upgraded from Tiger to Leopard and it has a slightly different /System/Library/LaunchDaemons/com.apple.syslogd.plist file. The main problem is that it does not appear to have the comment I referred to. So to enable it you need to un-comment the NetworkListener key and following dict lines. Unfortunately, I can not get this syslog server to work.

Google Go! on Mac OS-X

Google have just released a new programming language called Go.

I decided to install it and learn it.

This is what I did on Leopard 10.5.8. It took 5 easy steps (thanks to Kelvin Wong).

Step 1.

I installed mercurial (the Google instructions to use easy_install did not work for me)

Step 2.

I added these lines to ~/.profile (Kevin added his to ~/.bash_profile)

To determine what file to edit or create requires you to follow a procedure because bash only reads in the first one it finds:

If you have a ~/.bash_profile file, edit it.
Else if you have a ~/.bash_login file, edit it.
Else if you have a ~/.profile file, edit it.
Else if you have a ~/.bashrc file, edit it.
Else you may create one of the above.

I already had a ~/.profile file since I use fink and it creates one. Others have used ~/.bash_profile or ~/.bashrc.

export GOROOT=$HOME/go
export GOARCH=386
export GOOS=darwin
export GOBIN=$HOME/bin
export PATH=$GOBIN:$PATH

I then closed and re-opened the terminal session.

I checked that it worked with

env | grep '^GO'

Step 3.

I manually created ~/bin and followed Kelvin's recommendation to make it executable with

mkdir ~/bin
chmod 755 ~/bin

Step 4.

I downloaded the Go repository using mercurial.

hg clone -r release https://go.googlecode.com/hg/ $GOROOT

This printed the following:

requesting all changes
adding changesets
adding manifests
adding file changes
added 4016 changesets with 16888 changes to 2931 files
updating working directory
1640 files updated, 0 files merged, 0 files removed, 0 files unresolved

Step 5.

I built the Go compiler.

cd $GOROOT/src
./all.bash

During this step, OS-X asked me to allow in incoming connection to an application called 8g.

This didn't seem to work as I got this error:

FAIL: http.TestClient
Get http://www.google.com/robots.txt: dial tcp www.google.com:http: lookup www.google.com. on 10.x.x.x:53: no answer from server

This group discussion on the error suggests that Go is actually built but that the Go DNS resolver may not work on OS-X just yet.

It will work if 'Allow all incoming connections' is selected in the Firewall section of the Security preferences.

Running an SNMP Agent on OS-X Leopard 10.5.x

I have been writing a awk script to parse SNMP data. The data would be collected using snmpbulkwalk, piped through the awk script and the output can be saved to a file or piped through some XML processor.

eg.


snmpbulkwalk -v2c -cpublic -OXf some.ip.address > machine.snmpwalk
snmpbulkwalk -v2c -cpublic -OXf some.ip.address | awk -f script.awk | xmllint --format - > machine.snmpwalk.xml

To test it I wanted an SNMP agent running on OS-X. I found this web page helpful so thought I would document my experience here.

Unix Alert

This post assumes that you understand most of the jargon and Unix commands that come with OS-X. I also use programs from the fink project.

Edit /etc/hostconfig

I used joe (from fink), but you could use nano or any other text editor.

1. sudo joe /etc/hostconfig
2. Change SNMPSERVER=-NO- to -YES-

NB: I haven't rebooted yet so I don't know if the SNMP agent starts automatically. For me this is not important since I am only testing and not wanting the actually collect SNMP data.

# This file is going away

AFPSERVER=-NO-
AUTHSERVER=-NO-
AUTOMOUNT=-YES-
NFSLOCKS=-AUTOMATIC-
NISDOMAIN=-NO-
TIMESYNC=-YES-
QTSSERVER=-NO-
WEBSERVER=-NO-
SMBSERVER=-NO-
SNMPSERVER=-YES-

Edit /System/Library/LaunchDaemons/org.net-snmp.snmpd.plist

To make the SNMP agent start at boot time I found this post which explains that you need to edit /System/Library/LaunchDaemons/org.net-snmp.snmpd.plist and to change the element following the Disabled key from true to false.

<key>Disabled</key>

<false/>

Creating the SNMP Agent Configuration Files

You could do it manually, but why would you?

sudo /usr/bin/snmpconf -i

Notes

• It asked me to merge in an existing file in /etc/snmp/snmpd.conf which I did.
• I only created the snmpd.conf file.
• I only changed the Access Control Setup (but you could do this manually if you prefer).
• I later manually edited the file to change the location and contact details.

Here is a shortened log:


fox:pc-snmp2xml phil$ sudo /usr/bin/snmpconf -i

The following installed configuration files were found:

1: /etc/snmp/snmpd.conf

Would you like me to read them in? Their content will be merged with the
output files created by this session.

Valid answer examples: "all", "none","3","1,2,5"

Read in which (default = all):

I can create the following types of configuration files for you.
Select the file type you wish to create:
(you can create more than one as you run this program)

1: snmpd.conf
2: snmptrapd.conf
3: snmp.conf

Other options: quit

Select File: 1

The configuration information which can be put into snmpd.conf is divided
into sections. Select a configuration section for snmpd.conf
that you wish to create:

1: Access Control Setup
2: Extending the Agent
3: Monitor Various Aspects of the Running Host
4: Agent Operating Mode
5: System Information Setup
6: Trap Destinations

Other options: finished

Select section: 1

Section: Access Control Setup
Description:
This section defines who is allowed to talk to your running
snmp agent.

Select from:

1: a SNMPv3 read-write user
2: a SNMPv3 read-only user
3: a SNMPv1/SNMPv2c read-only access community name
4: a SNMPv1/SNMPv2c read-write access community name

Other options: finished, list

Select section: 3

Configuring: rocommunity
Description:
a SNMPv1/SNMPv2c read-only access community name
arguments: community [default|hostname|network/bits] [oid]

The community name to add read-only access for: public
The hostname or network address to accept this community name from [RETURN for all]:
The OID that this community should be restricted to [RETURN for no-restriction]:

Finished Output: rocommunity public

Section: Access Control Setup
Description:
This section defines who is allowed to talk to your running
snmp agent.

Select from:

1: a SNMPv3 read-write user
2: a SNMPv3 read-only user
3: a SNMPv1/SNMPv2c read-only access community name
4: a SNMPv1/SNMPv2c read-write access community name

Other options: finished, list

Select section: finished

The configuration information which can be put into snmpd.conf is divided
into sections. Select a configuration section for snmpd.conf
that you wish to create:

1: Access Control Setup
2: Extending the Agent
3: Monitor Various Aspects of the Running Host
4: Agent Operating Mode
5: System Information Setup
6: Trap Destinations

Other options: finished

Select section: finished

I can create the following types of configuration files for you.
Select the file type you wish to create:
(you can create more than one as you run this program)

1: snmpd.conf
2: snmptrapd.conf
3: snmp.conf

Other options: quit

Select File: quit


The following files were created:

snmpd.conf installed in /usr/share/snmp

Manually Editing the SNMP Agent Configuration File

I used joe (from fink), but you could use nano or any other text editor.


sudo joe /usr/share/snmp/snmpd.conf


Starting the SNMP Agent

Note: This is also required to start the agent after a reboot.


sudo /usr/sbin/snmpd

Testing the SNMP Agent

snmpbulkwalk -v2c -cpublic 127.0.0.1

You should see something like this:

SNMPv2-MIB::sysDescr.0 = STRING: Darwin fox.local 9.8.0 Darwin Kernel Version 9.8.0: Wed Jul 15 16:55:01 PDT 2009; root:xnu-1228.15.4~1/RELEASE_I386 i386
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.255
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (173086) 0:28:50.86
SNMPv2-MIB::sysContact.0 = STRING: bill
SNMPv2-MIB::sysName.0 = STRING: fox.local
SNMPv2-MIB::sysLocation.0 = STRING: Redmond

SNMP to XML

In a later post, I will publish my SNMP to XML script.

UPDATE: Instead of doing this, I started an Open Source project which can be found here.

Apache Tomcat 5.5 Installation on Mac OS-X Leopard 10.5.x

I needed to get Apache Tomcat 5.5 running on my Mac to experiment with Orbeon.

This was the most helpful information that I found, but I needed some extra steps.

1. Download Apache Tomcat 5.5 from here. Use the zip file since, for some reason, the README says that the tar shipped with OS-X is no good.

2. Move the downloaded zip file to where you want to unpack it. I choose my home directory which is /Users/phil

3. Open it and it should expand into a directory like /Users/phil/apache-tomcat-5.5.28

4. Browse to /Users/phil/apache-tomcat-5.5.28/bin

5. Open startup.sh with TextEdit.app

6. Add the following lines to the file after the EXECUTABLE line:

export JAVA_HOME=/System/Library/Frameworks/JavaVM.framework/Versions/1.5/Home
export CATALINA_HOME=/Users/phil/apache-tomcat-5.5.28

You will need to use the location where you placed the tomcat directory rather than mine.

7. I had to do three more things at this point to make all the shell (.sh) file executable.

1. Open Terminal.app
2. cd /Users/phil/apache-tomcat-5.5.28/bin
3. chmod u+x *.sh

8. Start tomcat this way:

./startup

I had another problem at this point. I already had an eXist server running on port 8080. eXist is included in Orbeon as well.

To change the port I needed to open /Users/phil/apache-tomcat-5.5.28/conf/server.xml and edit the line containing

Connector port="8080" maxHttpHeaderSize="8192

I changed the 8080 to 8180. You can choose almost any other port if that suits you situation better.

I still couldn't get tomcat to run. I found that it was already running so I had to kill it and then restart it.

I used the following command in Terminal to locate the program:

ps | grep tomcat

This generated the following lines. Ignore the 'grep tomcat' one and note the number of the second line - the 838 in my case.

3821 ttys000 0:00.00 grep tomcat
838 ttys007 0:10.71 /System/Library/Frameworks/JavaVM.framework/Versions/1.5/Home/bin/java -Djava.util.logging.config.file=/Users/phil/apache-tomcat-5.5.28/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.endorsed.dirs=/Users/phil/apache-tomcat-5.5.28/common/endorsed -classpath /Users/phil/apache-tomcat-5.5.28/bin/bootstrap.jar -Dcatalina.base=/Users/phil/apache-tomcat-5.5.28 -Dcatalina.home=/Users/phil/apache-tomcat-5.5.28 -Djava.io.tmpdir=/Users/phil/apache-tomcat-5.5.28/temp org.apache.catalina.startup.Bootstrap start

Now I had to kill the server with this command:

kill 838

Now I could restart tomcat and see the default home page.

I then pointed my browser to http://localhost:8180 and the default page was displayed.