CSP: the reception of the logs
CSP (Central Syslog) receives the logs of the devices of the customers on the ports of their subscriptions. If the reception stops, the logs sent over UDP at that moment are lost. Modules › Log reception is the page you keep an eye on it with.
The state of the reception
At the top the page says how the reception is now: "The server is receiving the logs (checked at …)", or the problem under way. The check runs every minute.
Below, the list of the interruptions, with From, To, Duration and Cause:
- Reception stopped (restart or shutdown): a restart of the reception service or a shutdown of the server; start and end are accurate to the second;
- Server stopped without warning: a fault or a power cut. The start is the last check before, approximate to the minute.
The customers see each interruption among their logs, where it falls, and in the reports. When the reception stays stopped for a few minutes you receive a notification, and another when it starts again.
Logs that do not reach the database
The reception service (rsyslog) can be running and still not write the logs, for example when the database refuses a message and rsyslog retries it for ever. Every minute the panel sends a test message along the path of the logs: when it does not arrive for a few minutes, the page shows it and you receive a notification.
Meanwhile the logs wait in the queue of rsyslog, up to 1 GB, and reach the customers when the problem is solved; the alerts of silent devices are suspended.
Look at the log of rsyslog on the server, for example with journalctl -u rsyslog.
Ports without an answer
rsyslog can also be running and not listen on some reception ports, when it could not start them. Every minute the panel compares the ports rsyslog listens on with all the reception ports: when some are missing for a few minutes, the page says how many and you receive a notification with the first ones.
The devices that send to those ports lose their logs until rsyslog is restarted: look at its log and restart it with systemctl restart rsyslog.
The ports in the firewall
The reception ports of the subscriptions, and 514 and 6514 of the dedicated addresses, are opened by the panel among the Rules of Esapanel of the firewall: you do not need to open them by hand (see Network and security). If the server is behind an external firewall or NAT, the ports must be opened there by hand.
The certificate
The TLS port and the port of the agents use the certificate of the panel: with a self-signed certificate the devices cannot verify it, and the agents do not send over TLS. Use a valid certificate, from Let's Encrypt or uploaded (see Certificates, mail and DNS).