Page MenuHomeVyOS Platform
Create Task
Maniphest T7290

VPN IPsec log level does not work
Closed, ResolvedPublicBUG
Actions

Description

VPN IPsec log level does not work

set vpn ipsec authentication psk PSK id '192.0.2.1'
set vpn ipsec authentication psk PSK id '192.0.2.2'
set vpn ipsec authentication psk PSK secret '1234567890'
set vpn ipsec esp-group ESP-group lifetime '3600'
set vpn ipsec esp-group ESP-group mode 'tunnel'
set vpn ipsec esp-group ESP-group pfs 'enable'
set vpn ipsec esp-group ESP-group proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-group proposal 1 hash 'sha1'
set vpn ipsec ike-group IKE-group key-exchange 'ikev2'
set vpn ipsec ike-group IKE-group lifetime '28800'
set vpn ipsec ike-group IKE-group proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-group proposal 1 hash 'sha1'
set vpn ipsec interface 'eth1'
set vpn ipsec log level '2'
set vpn ipsec site-to-site peer OFFICE-B authentication local-id '192.0.2.1'
set vpn ipsec site-to-site peer OFFICE-B authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '192.0.2.2'
set vpn ipsec site-to-site peer OFFICE-B connection-type 'initiate'
set vpn ipsec site-to-site peer OFFICE-B ike-group 'IKE-group'
set vpn ipsec site-to-site peer OFFICE-B local-address '192.0.2.1'
set vpn ipsec site-to-site peer OFFICE-B remote-address '192.0.2.2'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 esp-group 'ESP-group'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 local prefix '100.64.1.0/24'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 remote prefix '100.64.2.0/24'

For 1.4.x
Expected 2 for the charon.syslog.daemon.default option in the file /etc/strongswan.d/charon-logging.conf

But this option does not work.

vyos@r14# cat /etc/strongswan.d/charon-logging.conf 

charon {
    syslog {
        # prefix for each log message
        identifier = charon
        # use default settings to log to the LOG_DAEMON facility
        daemon {
            default = 1
            ike_name = yes
        }
    }
}

I do not see that we parse and use log.level option anywhere in the templates https://github.com/vyos/vyos-1x/tree/current/data/templates/ipsec

For the rolling expected for logging file

vyos@r14# cat /etc/strongswan.d/charon-systemd.conf 

charon-systemd {

    # Section to configure native systemd journal logger, very similar to the
    # syslog logger as described in LOGGER CONFIGURATION in strongswan.conf(5).
    journal {

        # Loglevel for a specific subsystem.
        # <subsystem> = <default>

        # Default loglevel.
        default = 2
    }

}

Details

Version
VyOS 2025.03.27-0018-rolling, 1.4.1
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

Viacheslav created this task.Mar 27 2025, 12:00 PM
Viacheslav triaged this task as Normal priority.
pasik subscribed.Mar 27 2025, 12:32 PM
Viacheslav changed the task status from Open to In progress.Apr 1 2025, 11:17 AM
Viacheslav claimed this task.
Viacheslav added a comment.Apr 2 2025, 11:56 AM

PR https://github.com/vyos/vyos-1x/pull/4431

Viacheslav updated the task description. (Show Details)Apr 2 2025, 11:58 AM
Viacheslav mentioned this in rVYOSONEX453c5e6dc90f: T7290: Fix VPN IPsec log level processing.Apr 3 2025, 2:58 PM
Restricted Repository Identity mentioned this in rVYOSONEX85d44fbe2bef: Merge pull request #4431 from sever-sever/T7290.Apr 3 2025, 2:58 PM
dmbaturin closed this task as Resolved.May 8 2025, 11:13 AM
dmbaturin moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.3) board.
dmbaturin moved this task from Open to Finished on the VyOS 1.5 Circinus board.
dmbaturin moved this task from Need Triage to Completed on the VyOS Rolling board.
dmbaturin edited projects, added VyOS 1.5 Circinus (1.5-stream-2025-Q2); removed VyOS 1.5 Circinus.Jul 9 2025, 11:49 AM
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
dmbaturin mentioned this in 1.4.3.Jul 17 2025, 8:18 AM
j.vela subscribed.May 21 2026, 2:34 PM

Noticed the charon-logging.conf and charon-systemd.conf affects logs in the system journal logs only. However, as the bug describes, the "set vpn log level 0/1/2" only modifies the charon-systemd.conf, and by default, the value of charon-logging.conf is 1, which leads journald to collect logs at level 1 (includes DPD logs) and not level 0 (only up/down and audit events) as was configured on charon-systemd.conf, by the "set vpn log level 0" command.

Since strongswan logs are based on the rsyslog configuration, it's ok to leave charon-logging.conf at level 1 by default and configure the syslog local facilities levels to any level (warning, errors, etc.) on VyOS. Therefore, if we want to check logal vpn logs at the configured level, we have to configure the "system syslog local facility all level warning/error" as the same level configured on "set vpn ipsec log level 0/1/2".

But if we want to configure the journal logs at any level -1 to 4, then it's necessary to create a VyOS command to modify charon-logging.conf file.

Despite this, there is a correlation between the charon-logging.conf and charon-systemd.conf for logs in the system journal. This is what I have found in 1.5.0 LTS version:

vyos@vyos# sudo cat /etc/strongswan.d/charon-systemd.conf
# Generated by ${vyos_conf_scripts_dir}/vpn_ipsec.py

charon-systemd {

    # Section to configure native systemd journal logger, very similar to the
    # syslog logger as described in LOGGER CONFIGURATION in strongswan.conf(5).
    journal {

        # Loglevel for a specific subsystem.
        # <subsystem> = <default>

        # Default loglevel.
        default = 0   --> log level
    }

}
  • If the charon-logging.conf logs level is higher than charon-systemd.conf, we will see in the system journal logs, the level configured in charon-logging.conf. i.e.

level log in logging.conf = 1
level log in systemd.conf = 0

//Result
Journal logs level = 1 (from logging.conf)

  • The other way around, if charon-systemd.conf is higher than charon-logging.conf logs, then we will see in the system journal logs, the level in charon-systemd

level log in logging.conf = 0
level log in systemd.conf = 2

//Result
Journal logs level = 2 (from systemd.conf)

Few suggested modifications:

*Leave charon-logging.conf at -1 by default and let charon-systemd handle populating the logs in the system journal.

Viacheslav added a comment.May 21 2026, 3:20 PM

@j.vela, this task was closed a year ago.
If you want to change something, you have to add a new task/feature/bug report.