Ship logs off the box#

You will end up with the router's journal arriving at a collector you already run. That matters for two reasons: the journal is not persistent across reboots on a stock Debian base unless /var/log/journal exists, and a router you cannot reach is a router whose logs you cannot read.

Before you start#

The operator role and a licence.
A syslog collector's address, and whether it takes UDP or TCP.

Step 1 — Add the remote#

System → Settings → Remote syslog.

set system syslog remote 192.0.2.60 facility all level info
set system syslog remote 192.0.2.60 port 514
set system syslog remote 192.0.2.60 protocol tcp

The panel writes port only when you give one, and protocol only when it is not udp.

The levels the panel offers, in order: emerg, alert, crit, err, warning, notice, info, debug, all. info is a sensible default — debug on a busy router is a lot of traffic, and all includes it.

More than one remote is allowed. Add a line per collector.

Step 2 — Commit and watch it arrive#

Check it worked#

On the collector, entries from the router's host name should start arriving immediately.

On the router, generate one on purpose:

bash

logger -t test "hello from the router"

Then look for it on the collector. If nothing arrives:

bash

show configuration commands | match syslog
journalctl -u rsyslog -n 30

What this does not carry#

The audit log is not in the journal

Who changed what through the agent is in /config/wheelhouse/audit.jsonl, not in systemd's journal, and there is no way to ship it to a syslog collector or a SIEM. No hash chain, no sequence numbers, no append-only mode. Root on the box can rewrite it invisibly, and fleet writes are not recorded in it at all.

If you need an off-box record of configuration changes, the honest answer today is to poll GET /api/audit on a schedule from somewhere else and keep what it returns:

bash

R=https://<router>:8443
T=wh_...
curl -sk -H "Authorization: Bearer $T" "$R/api/audit?limit=300" > audit-$(date +%F).json

That is a workaround, not a feature.

The agent's own logs are in the journal — structured, one line per request with method, route, status, duration and client address — so a syslog collector does see who is calling the API, if not what they changed.

Turning up the agent's own detail#

The agent takes --log-level debug, set with a systemd drop-in rather than by editing the packaged unit, which an image upgrade replaces.

/etc/systemd/system/wheelhouse-agent.service.d/loglevel.conf

[Service]
ExecStart=
ExecStart=/usr/bin/wheelhouse-agent … --log-level debug

Repeat every flag the packaged unit passes; the empty ExecStart= clears the original.

Undoing it#

delete system syslog remote 192.0.2.60

The panel's remove on the remote's row stages that.

Ship logs off the box#

Before you start#

Step 1 — Add the remote#

Step 2 — Commit and watch it arrive#

Check it worked#

What this does not carry#

Turning up the agent's own detail#

Undoing it#

See also#