Logs and counters

Remote syslog

One line sends every log message at info or above to the ops server. Logs on the router itself are lost when it reboots (or is replaced), and you can't search across routers. A central log server fixes both.

It's also a free audit trail. The very first messages to arrive included R1 recording its own commit: Successful change to active configuration by user vyos on /dev/ttyS0. Every configuration change is logged with who made it and how.

SNMP

SNMP lets a monitoring system poll the router's counters: interface traffic, errors, uptime. Graph tools like LibreNMS, Zabbix or Prometheus's SNMP exporter poll every few minutes and draw the graphs you'll want during an incident.

The lab uses SNMPv2c with a read-only community, restricted to the ops server's address and listening only on the management address. From the ops server:

• snmpget returns the system description (the exact VyOS build), uptime, name and location.
• Walking ifName (1.3.6.1.2.1.31.1.1.1.1) lists the interfaces and their index numbers.
• ifHCInOctets for index 2 (eth0) is a 64-bit byte counter: always use the HC (high-capacity) counters, because 32-bit ones wrap in seconds on fast links.
• The wrong community gets no answer at all, not an error, so a typo looks exactly like a firewall problem.

(The numeric object IDs are because Debian doesn't ship the standard MIB files. -m "" tells the tools not to look for them. With MIBs installed, you'd write IF-MIB::ifName.)

SNMPv2c sends the community in clear text. On anything but an isolated management network, use SNMPv3 with authentication and encryption.

root@ops:~# tail -n 5 /var/log/r1.log
2026-10-17T14:57:43+00:00 R1 kernel: ipt_NETFLOW is loaded.
2026-10-17T14:57:45+00:00 R1 systemd[1]: opt-vyatta-config-tmp-new_config_3812.mount: Deactivated successfully.
2026-10-17T14:57:47+00:00 R1 commit[4149]: Successful change to active configuration by user vyos on /dev/ttyS0
2026-10-17T14:57:47+00:00 R1 vyos-netlinkd[2026]: Config commit finished, reconciling DHCP client state with operstate
2026-10-17T14:57:47+00:00 R1 systemd[1]: opt-vyatta-config-tmp-new_config_3812.mount: Deactivated successfully.

root@ops:~# snmpget -v2c -c ttr-lab-ro -m "" 198.51.100.1 1.3.6.1.2.1.1.1.0 1.3.6.1.2.1.1.3.0 1.3.6.1.2.1.1.5.0 1.3.6.1.2.1.1.6.0
iso.3.6.1.2.1.1.1.0 = STRING: "VyOS 2026.10.16-0024-rolling"
iso.3.6.1.2.1.1.3.0 = Timeticks: (103419) 0:17:14.19
iso.3.6.1.2.1.1.5.0 = STRING: "R1"
iso.3.6.1.2.1.1.6.0 = STRING: "Lab rack 1"
root@ops:~# snmpwalk -v2c -c ttr-lab-ro -m "" 198.51.100.1 1.3.6.1.2.1.31.1.1.1.1
iso.3.6.1.2.1.31.1.1.1.1.1 = STRING: "lo"
iso.3.6.1.2.1.31.1.1.1.1.2 = STRING: "eth0"
iso.3.6.1.2.1.31.1.1.1.1.3 = STRING: "pim6reg"
root@ops:~# snmpget -v2c -c ttr-lab-ro -m "" 198.51.100.1 1.3.6.1.2.1.31.1.1.1.6.2
iso.3.6.1.2.1.31.1.1.1.6.2 = Counter64: 11016
root@ops:~# snmpget -v2c -c wrong-community -m "" -t 2 -r 0 198.51.100.1 1.3.6.1.2.1.1.5.0
Timeout: No Response from 198.51.100.1.