Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[questionableuser]

Hello,
   So I come with the question of is it possible to turn off the logging on the router if I am using a remote syslog?
Under tool->syslog I have it set to log to my remote syslog server (rsyslog) and I am receiving logs on my server however the router is also logging and I would like to not have it log anything with the syslog server being the only thing that logs. In the router status->logs I have disabled all the logging and at that point I no longer receive any logs on my remote server.

My configuration of rsyslog on my remote server is

Code: [Select]

$template NetworkLog, "/var/log/netgear.log"
:fromhost-ip, isequal, "192.168.0.1" -?NetworkLog
& ~
Can anyone shed some light on what it is I am doing wrong or how to accomplish what it is I am after?

[FurryNutz]

Link>Welcome!

• What Hardware version is your router? Look at sticker under the router case.
• Link>What Firmware version is currently loaded? Found on the routers web page under status.
• What region are you located?

Goto: http://192.168.0.1/Status/Logs.shtml
then uncheck all boxes and save the setting.

[questionableuser]

H/W Version: A2
Firmware Version :
1.23NA,  2010/04/15
Region: USA

As I said when I uncheck all the options in Status->Logs and save I no longer receive any logs in my remote rsyslog server. 

[FurryNutz]

What happens if you select just one check box?

[questionableuser]

What happens if you select just one check box?

Whatever I check is what is sent to the remote syslog server and is also logged by the router.

[FurryNutz]

Well seem you found something. So if you select ALL boxes you get everything to the external server and if only one box you get only the one box. Interesting.
Seems like a design issue that may have been over looked. 

[questionableuser]

Well seem you found something. So if you select ALL boxes you get everything to the external server and if only one box you get only the one box. Interesting.
Seems like a design issue that may have been over looked. 

This is what I am also thinking that logging, remote as well, depends on the settings checked in Status->Logs. I think we all know about the mira botnet and I am getting scanned to the point my router logs get full within a 24-36 hour period and the router starts acting up so I have to clear the logs. This is why I wanted to log to a remote server instead. If the option to disable logging on the router with remote logging enabled does not exist does some type of option that I have not seen exist that would allow me to auto clear the logs on the router?

[FurryNutz]

The only thing I can recommend is to select the boxes that you need and clear the other ones. You'll need to click on the CLEAR to clear out the logs if the router seems to be acting up.

I don't have firewall and security and Warnings selected on mine currently. I have 1996 entries currently. Router seems to be ok.

If your getting scanned a lot, I would have the ISP change your WAN IP address and see if they can block any malicious IP addresses that the router is picking up.
This around is 10 years old and last FW update was a long time ago and hasn't been anything since and won't be. The router is still good, so you may need to help it along if your going to keep using it. See if you can get the ISP to stop any malicious IPs

[questionableuser]

The only thing I can recommend is to select the boxes that you need and clear the other ones. You'll need to click on the CLEAR to clear out the logs if the router seems to be acting up.

I don't have firewall and security and Warnings selected on mine currently. I have 1996 entries currently. Router seems to be ok.

If your getting scanned a lot, I would have the ISP change your WAN IP address and see if they can block any malicious IP addresses that the router is picking up.
This around is 10 years old and last FW update was a long time ago and hasn't been anything since and won't be. The router is still good, so you may need to help it along if your going to keep using it. See if you can get the ISP to stop any malicious IPs

Thank you for the advice, I guess I will have to tough it out and manually clear the logs on the router until I upgrade. I know the router is end of life but it is still, in my opinion, one of the best routers in the series but sadly it seems it is lacking in some aspects.

[FurryNutz]

See if you can stop the scans and such. Thats your main problem. The isp should be able to help. Not sure if blocking anything on the router will help. Just occasionally clear the logs. Select only the logging that you really need. Maybe once the scan storm is stopped then you can go back to logging one or two items.

Ya, the 4500 was one of the best I ever bought. I wish they had done a few more things with it. It's a solid router. I have mine connect with a DIR-890L running as a wireless AP. I turned OFF the radios on the 4500.

Also since the code is getting to be old and newer tech code and bugs have been seen over the years, the 4500 may suffer from issues from these. Hard to say. At some point, a new router should be looked at that has up to date code and security patches.