Enabling MacOS X Lion syslog server for use with a DrayTek router

The DrayTek routers are offering to log to a syslog server. However DrayTek's own tool isn't working anymore because Lion dropped out Rosetta. So I came up with an idea to directly log to a Mac syslog server. Here is how to do that.

First you need to edit the com.apple.syslogd.plist which is found in /System/Library/LaunchDaemons and add a child entry (NetworkListener) under the Sockets dictionary.

If the file is in binary mode you need to convert it to xml first. Type the following in a terminal window.

    sudo plutil -convert xml1 /System/Library/LaunchDaemons/com.apple.syslogd.plist

<plist version="1.0">

<dict>

<key>EnableTransactions</key>

<true/>

<key>EnvironmentVariables</key>

<dict>

<key>ASL_DISABLE</key>

<string>1</string>

</dict>

<key>HopefullyExitsLast</key>

<true/>

<key>JetsamProperties</key>

<dict>

<key>JetsamMemoryLimit</key>

<integer>300</integer>

<key>JetsamPriority</key>

<integer>-49</integer>

</dict>

<key>Label</key>

<string>com.apple.syslogd</string>

<key>MachServices</key>

<dict>

<key>com.apple.system.logger</key>

<true/>

</dict>

<key>OnDemand</key>

<false/>

<key>ProgramArguments</key>

<array>

<string>/usr/sbin/syslogd</string>

</array>

<key>Sockets</key>

<dict>

<key>AppleSystemLogger</key>

<dict>

<key>SockPathMode</key>

<integer>438</integer>

<key>SockPathName</key>

<string>/var/run/asl_input</string>

</dict>

<key>BSDSystemLogger</key>

<dict>

<key>SockPathMode</key>

<integer>438</integer>

<key>SockPathName</key>

<string>/var/run/syslog</string>

<key>SockType</key>

<string>dgram</string>

</dict>

<key>NetworkListener</key>     <<<<------ start adding here

<dict>

<key>SockServiceName</key>

<string>syslog</string>

<key>SockType</key>

<string>dgram</string>

</dict>                        <<<<------ until here

</dict>

</dict>

</plist>

Edit the file and save. We need to convert the file back to binary mode.

        sudo plutil -convert binary1 /System/Library/LaunchDaemons/com.apple.syslogd.plist


After that you need to create a logfile. Open up a terminal window and type

        sudo touch /var/log/router.log

You can replace router.log with anything else you like.

Now in the same terminal window type 

        sudo nano /etc/syslog.conf

Add an entry to the file 

        local2.*            /path/to/your/logfile

and save the file (Ctrl+X, answer the question with Y).

Final thing to do on MacOS side is to restart the syslog daemon.

        sudo launchctrl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist

   sudo launchctrl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

The next step is to configure your DrayTek router. Under  System Maintenance >> SysLog / Mail Alert Setup check the "Enable" box and enter the ip address of your Mac under "Server IP address". The standard port 514 should not be altered. You can choose which events your router should forward to the syslog server. For initial testing leave all events checked. Click on "OK" and open up the Console app on your Mac. Navigate to your router.log on the left side. After a while you should see some entries.

Have fun...