Syslog error messages?

General questions
, , , , , , ,
1

I keep getting the following syslog messages. Any idea what this means?
I can confirm my NTP server is reachable within VRF, same as syslog server and I have added “set vrf bind-to-all”



Apr 17 06:51:25  systemd-tmpfiles[3883]: [/usr/lib/tmpfiles.d/resource-agents.conf:1] Duplicate line for path "/run/resource-agents", ignoring.
Apr 17 06:51:25  rsyslogd: omfwd/udp: socket 8: sendto() error: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: omfwd: socket 8: error 101 sending via udp: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: action 'action-2-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Apr 17 06:51:25  rsyslogd: omfwd/udp: socket 8: sendto() error: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: omfwd: socket 8: error 101 sending via udp: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: action 'action-2-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Apr 17 06:51:25  rsyslogd: omfwd/udp: socket 8: sendto() error: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: omfwd: socket 8: error 101 sending via udp: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: action 'action-2-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
Apr 17 06:51:25  rsyslogd: omfwd/udp: socket 8: sendto() error: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: omfwd: socket 8: error 101 sending via udp: Network is unreachable [v8.1901.0 try https://www.rsyslog.com/e/2354 ]
Apr 17 06:51:25  rsyslogd: action 'action-2-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for suspension. [v8.1901.0 try https://www.rsyslog.com/e/2007 ]
2

Seems like packets send from syslog deamon do not come from mentioned VRF, but some global VRF instead

3

In VyOS syslog is always in default VRF. There is no configuration option for that.

You can make it manually. Don’t configure syslog server in VyOS and add in vyos-postconfig-bootup.script this lines:

echo '*.notice;local7.debug action(type="omfwd" Target="<your_syslog_server>" Port="514" Protocol="udp" Device="<your_vrf_from_vyos_config>")' >> /etc/rsyslog.d/vyos-rsyslog.conf
service rsyslog restart

*.notice;local7.debug means:

 facility all {
     level notice
 }
 facility protocols {
     level debug
 }

Tested on 1.3.

4

I have an interface, on a VRF, that is directly connected to the syslog server.
I also have an interface, Global VRF, that is not connected directly to the syslog server and I route the traffic to Syslog server via that interface using static route. So, there is reachability via Global table.

I can also see some syslog messages on my syslog server, so vyos can send it there.
These log messages I posted is just a bit noisy.