System

System Logging

SoodarOS uses systemd-journald as the central logging solution.

[no] debug service snmp

Enable logging for SNMP service. All SNMP logs appear in journald.

[no] debug service mender

Enable logging for mender update service. All mender logs appear in journald.

[no] debug service ntpd

Enable logging for NTP service. All NTP logs appear in journald.

[no] debug service dhcp4

Enable logging for DHCP4 server service. All logs appear in journald.

[no] debug dplane fib

Enable data plane( VPP) FIB logs.

[no] debug dplane ipsec

Enable data plane( VPP) IPSec logs.

log rotate max-file-size SIZE

set SIZE as the limit of how sizeable individual journal files may grow at most. When a limit is reached, it rotates to the next journal file.

log rotate max-files (1-1000)

control how many individual journal files to keep at most. Default is 100.

log rotate max-use SIZE

Control how much disk space the journal may use up at most. The SIZE is capped at 4G. After reaching the limit, it starts removing elder journal files.

[no] log rotate max-file-life (1-1000)

The maximum time( in days) to store entries in a single journal file before rotating to the next one.

[no] log rotate max-retention (1-1000)

The maximum time( in days) to store journal entries. This controls whether journal files containing entries older than the specified period are deleted.

[no] log file [LEVEL]

If you want to enable log into a file, please enter the command as in this example:

log file  informational

If the optional second argument specifying the logging level is not present, the default logging level (typically debugging, but can be changed using the deprecated log trap command) is used. The no form of the command disables logging to a file.

[no] log syslog [LEVEL]

Enable logging output to syslog. If the optional second argument specifying the logging level is not present, the default logging level (typically debugging, but can be changed using the deprecated log trap command) is used. The no form of the command disables logging to syslog. Default log level for syslog is set to error level.

[no] log syslog [A.B.C.D|HOST] tcp [tls [skip-host-verify]] [port (100-65535)]

Define a remote host to send syslogs. Make sure that log syslog is enabled to make this command work. The default port is 514. Users can enable TLS connection. By adding skip-host-verify option, the remote hostname is not checked against provided certificate CN/SAN.

Example:

soodar(config)# ip host logServer 1.1.1.1
soodar(config)# log syslog logServer tcp tls

[no] log syslog HOST loki [skip-host-verify] [port (100-65535)]

Define a remote host to send syslogs. Make sure that log syslog is enabled to make this command work. The default port is 3000. By adding the skip-host-verify option, the remote hostname is not checked against the provided certificate CN/SAN in the HTTPS connection.

Note

Loki connection uses http or https protocols to communicate. User must provide the http or https in address.

Note

Port is a different option. User must not provide a port in an address like http://temp.ir:3100. It’s wrong!

Example:

soodar(config)# log syslog https://192.168.1.1 loki skip-host-verify port 3100

[no] log monitor [LEVEL]

Enable logging output to terminal shell. By default, monitor logging is enabled at the informational level, but this command can be used to change the monitor logging level. If the optional second argument specifying the logging level is not present, the default logging level (typically informational) is used. The no form of the command disables logging to terminal monitors.

[no] log facility [FACILITY]

This command changes the facility used in syslog messages. The default facility is daemon. The no form of the command resets the facility to the default daemon facility.

[no] log record-priority

To include the severity in all messages logged to a file. Use the log record-priority global configuration command. To disable this option, use the no form of the command. By default, the severity level is not included in logged messages.

[no] log timestamp precision [(0-6)]

This command sets the precision of log message timestamps to the given number of digits after the decimal point. Currently, the value must be 0 to 6 (i.e., the maximum precision is microseconds). To restore the default behavior (1-second accuracy), use the no form of the command, or set the precision explicitly to 0.

log timestamp precision 3

In this example, the precision is set to provide timestamps with millisecond accuracy.

[no] log commands

This command enables the logging of all commands typed by a user to all enabled log destinations.

show log all [follow]

Show all journals logs. If the follow mode is enabled, it follows the updates.

show log mender [follow]

Show mender update service logs. If the follow mode is enabled, it follows the updates.

show log ssh [follow]

Show SSH service logs. If the follow mode is enabled, it follows the updates.

show log soolog [follow]

Show Soodar service logs. We are using vector for logging. If the follow mode is enabled, it follows the updates.

show log snmpd [follow]

Show SNMP service logs. If the follow mode is enabled, it follows the updates.

show log ntpd [follow]

Show NTP service logs. If the follow mode is enabled, it follows the updates.

show log vpp [follow]

Show VPP service( data plane) logs. If the follow mode is enabled, it follows the updates.

show log frr [follow]

Show FRR service( control plane) logs. If the follow mode is enabled, it follows the updates.

show log ipsec [follow]

Show IPSec service logs. If the follow mode is enabled, it follows the updates.

show log kernel [follow]

Show kernel and boot logs. If the follow mode is enabled, it follows the updates.

clear log [syslog]

Clear all generated logs. Using the syslog keyword makes the journald logs vacuumed; otherwise, the log file is truncated.

System update

SoodarOS uses mender as its system update solution. It supports both online and offline updates, and in case of failure, it can roll back to the previous version

Online update

Update system from a server. It is disabled by default. When an online update is enabled, the system automatically checks the server for available updates and install if any is present.

Configuration

system update enable

Enable online update

no system update enable

Disable online update

system update server-url WORD

Set update server’s URL

Note

Update server address, should be a URL, and an IP address can’t be set

system update update-poll-interval (5-2147483647)

Check for update interval in seconds

system update inventory-poll-interval (5-2147483647)

Send system inventory in intervals. Unit is in seconds

Example:

soodar(config)# system update enable
soodar(config)# system update server-url https://update.soodar.ir
soodar(config)# system update update-poll-interval 300
soodar(config)# system update inventory-poll-interval 400

Offlline update

Update system from removable storage. The procedure to offline update is simple. One need to:

1. Install an update

2. Reboot

3. Commit the update( to make it persistent) or rollback the update( in case of failure. Reboot without a commit to rollback)

Note

To use offline update, the online update should be disabled

Configuration

system update offline list

List available updates on removable storage

Example:

n1(config)# system update offline list
    1   rls-20
    2   rls-21
    3   rls-21.1

system update offline install ARTIFACT

Install update from removable storage. ARTFICAT is the relative path of update file from removable storage root, without .mender postfix

system update offline commit

Commit latest installed update.

Warning

During the system’s booting, no removable storage should be plugged into the router device, or the boot fails.

System backup and restore

The router is equipped with a set of backup/restore tools. Currently, only startup-config could be backed up. The backup files could be stored in three ways:

1. To remote host and via SSH

2. To local storage

3. To removable storage

Backup and restore via SSH

Commands

system config backup ssh HOST USER PATH

Backup current startup-config to a remote host. HOST is the IP address or hostname of the desired destination USER is a remote host user that SSH tunnel is made to. And PATH is the address to save.

Examples:

soodar(config)# ip host bckup-server 192.168.1.123
soodar(config)# system config backup ssh bckup-server admin ~/backups/n1-edge
soodar(config)# system config backup ssh 10.12.12.1 sysadmin /var/router-backups/test_bkp

system config backup list ssh HOST USER PATH

List available backup files on remote hast. PATH is the remote destination directory that backups are stored

Example:

soodar(config)# system config backup list ssh bckup-server admin ~/backups

Tags in provided remote path:
    1   -rw-r--r-- 1 admin admin    0 Mar 17 10:33 n1-edge
    1   -rw-r--r-- 1 admin admin    0 Mar 16 19:52 n3

system config restore ssh HOST USER PATH

Example:

soodar(config)# system config backup restore ssh 10.12.12.1 sysadmin /var/router-backups/test_bkp

Backup and restore to and from removable storage

Commands

system config backup removable-storage NAME

Backup current startup config to the removable storage. NAME is desired backup’s name.

Examples:

soodar(config)# system config backup removable-storage before-a-big-change

system config backup list removable-storage

List available backup files on removable storage.

Example:

soodar(config)# system config backup list removable-storage

Tags in provided remote path:
    1   -rw-r--r-- 1 admin admin    0 Mar 17 10:51 before-a-big-change

system config restore removable-storage NAME

Backup and restore to and from local

Commands

system config backup local NAME

Backup current startup config to the local storage. NAME is desired backup’s name.

Examples:

soodar(config)# system config backup local before-a-big-change

system config backup list local

List available backup files on local storage.

Example:

soodar(config)# system config backup list local

Tags in provided remote path:
    1   -rw-r--r-- 1 admin admin    0 Mar 17 10:51 before-a-big-change

system config restore local NAME

Prometheus Monitoring

SoodarOS supports both SNMP and Prometheus for monitoring purposes. Users can enable Prometheus monitoring by running soomon service on the router. After running and enabling soomon service, the router can provide metrics on port 9200.

system service enable soomon

Start soomon service to provide Prometheus monitoring.

Note

Currently, soomon only works on port 9200. This behavior could change in the future.

System Services

Services are running in the background for accomplishing tasks. These services include:

• NTP: Network Time Protocol service.

• Mender: System update service.

• Soolog: Remote and local syslog service.

• SNMPD: SNMP Services

• VPP: Router service. Restarting this service is like restarting the router.

• soomon: Soodar Prometheus monitoring service.

show system service status SERVICE

Show service status based on the output of systemd

system service restart SERVICE

Restart a service. If service is not running, starts the service.

Note

An explicitly disabled service can not be restarted( for example, when a user has set no ntp command, one can not restart the NTP service).

System Security

The admin can set the maximum TCP SYN limit to protect the system from SYN flood attacks.

tcp syn-flood limit (1-4294967295)

Set TCP SYN limit. The default limit is 256.

URPF is a technique to help prevent IP Address spoofing by restricting the incoming packet’s source address to those that the router has a route to. Failed packets are discarded.

URPF has two modes of operation:

• Strict: Every ingress packet’s source is looked up in the FIB; if there’s a route to source address but the incoming interface is not the output interface of the path, the packet check fails.

• Loose: Every ingress packet’s source is looked up in the FIB; if there’s no route to source address by any interface, the packet is discarded.

ip verify unicast source reachable-via [rx | any]

Enable URPF on an interface. rx keyword set URPF in strict mode. The default mode is any ( loose mode).