Rsyslog hostname preservation in Ubiquiti Edge Router devices

This was tested and verified on an EdgeRouter X and a EdgeRouter PRO-8 running v1.9.7+hotfix.4

Ubiquiti Edge Router devices use rsyslog for syslog, but the default configuration does not preserve the FQDN of the router. This is causing complications in my Graylog/LibreNMS configuration.

After researching the problem I found that the three potential candidates to fix the issue are:

1. The hostname in the /etc/hosts file needs to be set to the FQDN. I tried this, it had no effect on the syslog output.
2. add "$PreserveFQDN on" to the syslog configuration. 
3. Append "$LocalHostName host.name.org" to the rsyslog config. 

All three configurations were made in varying order, but nothing worked. I had (incorrectly) assumed that since they were using rsyslog and /etc/rsyslog.conf existed, that /etc/rsyslog.conf would be the correct config file to edit. I even tried adding a new config file in /etc/rsyslog.d/ to no avail. 

The only changes that seemed to take were in /etc/rsyslog.d/vyatta-log.conf. The "$PreserveFQDN on" syntax didn't seem to have any effect by itself, even though the system domain-name is set properly. 

I tried to manually set the FQDN in /etc/rsyslog.d/vyatta-log.conf by  manually appending "$LocalHostName host.name.org" and restarting the rsyslog service. Again, it had no effect. Finally, adding both "$LocalHostName host.name.org" *and* "$PreserveFQDN on" worked. 

I haven't tested to see if these changes will be persistent through web interface config changes, but at least it's a start. 

UPDATE: It gets weirder, most syslog messages are making it to the server with the FQDN....except anything related to PAM. Strange...

Intel ATOM D525 Network Performance

I recently had the occasion to use a small Intel Atom D525 based Linux server to do some file transfers from one machine to another. I noticed that the file transfers were not very snappy, so I started to look closer at the issue. The Microtik switch that I'm using has a nice usage meter on each interface and I noticed that a single rsyc over ssh was only giving me 100-150Mb/s performance. Realizing that this was compressed and using the somewhat whimpy Atom CPU, I backed off to a minimal compression algorithm and ended up getting a modest improvement (200Mb/s). So, running 4 parallel rsyncs seemed to be the trick, but I seem to cap out around 5-600Mb/s:


The CPU seemed to hover around 40-50%, which was odd, I would have expected to see a higher percentage if my performance was capped.

I later tried NFS to see if that did the trick, but it too capped around 5-600Mb/s. The particular distribution of Linux I was using was Zentyal 3.5, but I also tried on an Ubuntu 14.04 Atom D525 system as well with the same results.

Just to make sure it wasn't something to do with the server I initiated a transfer from my desktop PC running Windows 7. You can see the server doesn't have any issues keeping up. In a later blog post I'll go into the ethernet switch I'm using and how changing the default queueing method affects performance in a positive manner.

The end result is that I wasn't able to push the Intel Atom D525 board beyond 5-600Mb/s. It could be an ethernet driver issue since the CPU didn't seem to be loaded beyond 50%, but I figured it would be an interesting datapoint to share. If anyone sees differently, please message me with your results.