CloudLabBox
Try the free demo

Linux for network engineers lab 11 of 14

Logs and time: syslog and NTP clients

You send Linux and router logs to one collector, break a clock to see why it matters, then fix it with NTP, serving time from a Linux box to a host and a router, and rotate the logs.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then Linux for network engineers guided labs, then 11 - Logs and time - syslog and NTP clients

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 65 minutes
Nodes need
4 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

An audit at Huddersfield asked a simple question: what happened at 09:15 last Tuesday? Nobody could say. The logs were scattered across boxes, and each box had its own idea of the time. You'll send everything to one place, put every device on one clock, and stop the logs filling the disk.

DeviceInterfaceAddressRole
WSeth010.11.1.50/24log collector, UDP 514
TIMEeth010.11.1.10/24NTP server, UDP 123
H1eth010.11.1.20/24Linux server
R1Gi0/010.11.1.1/24depot router
DeviceRunsHow to log in
WSUbuntu 22.04 desktop containerIts console is a remote desktop: root / eve. Open a terminal there.
H1Alpine Linux 3.20root, no password.
R1Cisco IOSv 15.9The console opens at >; enable has no password.
TIMEAlpine Linux 3.16 with iptables and iproute2Opens on a menu: press 5, then Enter, for a root shell.

What you’ll practise

  • Use facilities, severities and logger
  • Forward syslog from Linux and IOS to a collector
  • Read the priority value on the wire
  • Set clocks from an NTP server and read offset, stratum and reach
  • Rotate logs with logrotate

The tasks

  1. Start the Linux nodes
  2. Read and write local logs
  3. Send Linux logs to the collector
  4. Send router logs to the collector
  5. See why clocks matter
  6. Serve and use NTP
  7. Bring the router on to NTP
  8. Rotate the logs

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Logs and time - syslog and NTP clients4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.WSH1R1TIMELANeth0eth0eth0Gi0/0
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • WS eth0 to LAN (network)
  • H1 eth0 to LAN (network)
  • R1 Gi0/0 to LAN (network)
  • TIME eth0 to LAN (network)
Nodes in Logs and time: syslog and NTP clients, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
TIMEAlpine WAN emulatorclbalpinewanem-alpine-3-16-2-wanem1 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Linux for network engineers guided labs.

  3. Open 11 - Logs and time - syslog and NTP clients and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Linux for network engineers labs

All Linux for network engineers labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, the Linux Foundation and the Linux Professional Institute. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.