Checklist and troubleshooting
Checklist
- Remote syslog from every router, with timestamps you can trust (NTP on every router).
- SNMP (v3 where possible) restricted to your monitoring hosts, graphing the 64-bit interface counters.
- Flow export on edge interfaces, checked against known traffic.
- Commit archive to a server or a Git repository, with the server's host key recorded first.
commit-confirmfor every remote change.- Configuration changes through automation, run with
--check --difffirst, and idempotent.
When it doesn't work
| Symptom | Look at | Usual cause |
|---|---|---|
| No logs arriving | tcpdump udp port 514 on the server | Wrong address, or the server isn't listening on UDP |
| SNMP times out | The community and client list | Wrong community, or the poller isn't in the client list |
| Flows missing | Flow timeouts; the collector's files | Long flows not yet exported; collector on the wrong port |
| Archive upload fails | The commit output | Unknown host key, or wrong credentials or path |
| Commit-confirm rebooted the router | commit-confirm action | Default reboot; set reload |
Ansible always reports changed | The config lines in the playbook | Lines not written as they appear in show configuration commands |
vyos@R1:~$ show configuration commands | match "syslog|snmp|flow-accounting|config-management|banner"
set service snmp community ttr-lab-ro authorization 'ro'
set service snmp community ttr-lab-ro client '198.51.100.10'
set service snmp contact 'noc@example.net'
set service snmp listen-address 198.51.100.1
set service snmp location 'Lab rack 2'
set system config-management commit-archive location OPS scp authentication password 'backup-lab-only'
set system config-management commit-archive location OPS scp authentication username 'cfgbackup'
set system config-management commit-archive location OPS scp path '/home/cfgbackup/r1'
set system config-management commit-archive location OPS scp server '198.51.100.10'
set system config-management commit-confirm action 'reload'
set system config-management commit-revisions '100'
set system flow-accounting netflow active-timeout '30'
set system flow-accounting netflow inactive-timeout '15'
set system flow-accounting netflow interface 'eth0'
set system flow-accounting netflow server 198.51.100.10 port '2055'
set system flow-accounting netflow version '9'
set system login banner pre-login 'Authorised access only. Managed by Ansible.'
set system syslog local facility all level 'info'
set system syslog local facility local7 level 'debug'
set system syslog remote 198.51.100.10 facility all level 'info'- Lines 2–6: SNMP.
- Lines 7–12: Archive and commit-confirm.
- Lines 13–17: NetFlow.
- Line 18: Set by Ansible.
- Line 21: Remote syslog.