Cannot StrongSwan Logging to work

[tjmcclure0501]

I am having an issue getting StrongSwan to connect with a customer's VPN so I want to turn on file logging I can further troubleshoot the issue. Per the documentation I modified my strongswan.conf file to the following:

strongswan.conf - strongSwan configuration file

Refer to the strongswan.conf(5) manpage for details

Configuration changes should be made in the included files

charon {
# path to the log file, specify this as section name in versions prior to 5.7.0
path = /var/log/charon.log
# add a timestamp prefix
time_format = %b %e %T
# prepend connection name, simplifies grepping
ike_name = yes
# overwrite existing files
append = no
# increase default loglevel for all daemon subsystems
default = 4
# flush each line to disk
flush_line = yes
load_modular = yes
plugins {
include strongswan.d/charon/*.conf
}
}

I am obviously doing something wrong. Any ideas?

Tim

[strongX509]

Hi Tim,

I don' see the filelog keyword that is required for enabling file-based logging in etc/strongswan.conf:

# /etc/strongswan.conf
charon {
   filelog {
      charon {
         # path to the log file, specify this as section name in versions prior to 5.7.0
         path = /var/log/charon.log
         # add a timestamp prefix
         time_format = %b %e %T
         # prepend connection name, simplifies grepping
         ike_name = yes
         # overwrite existing files
         append = no
         # increase default loglevel for all daemon subsystems
         default = 2
         # flush each line to disk
         flush_line = yes
      }
   }
}

More details can be found on the strongSwan wiki:

https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration

[tjmcclure0501]

Thanks for help - it was a stupid mistake. This time I copied directly from the example and I still do not have any logs - weird. My file:
charon {
# two defined file loggers
filelog {
charon {
# path to the log file, specify this as section name in versions prior to 5.7.0
path = /var/log/charon.log
# add a timestamp prefix
time_format = %b %e %T
# prepend connection name, simplifies grepping
ike_name = yes
# overwrite existing files
append = no
# increase default loglevel for all daemon subsystems
default = 4
# flush each line to disk
flush_line = yes
}
}
}

include strongswan.d/*.conf

[tjmcclure0501]

I got it to work thru syslog - could not get file log to work.

[Thermi]

The path also needs to be writable for the process. Another path to try can be /tmp/charon.log. Apparmor and other security frameworks can prevent that, besides normal unix ACLs.