Re: [Openvpn-users] How to use easyrsa 3.2.2 on new server - questions

[Bo B. <bo....@gm...>]

On Tue, 1 Apr 2025 15:21:26 +0200, David Sommerseth via Openvpn-users
<ope...@li...> wrote:

>By default on most distributions today, you need to manually create the
>/var/log/journal directory to enable persistent logging - or set
>Storage=persistent in /etc/systemd/journald.conf.   Without this, the
>logging happens only in memory and is wiped across boots.
>
>So I strongly recommend you to use the systemd-journal.  It will give
>you access to all the log entries you're looking for incredibly quickly.
> And it's a tool you have available out-of-the-box.

Thanks for your description! It seems like I should perhaps stop using local
logging...

Follow-up questions:

1) If I do create the /var/log/journal dir on the server do I also remove the
log directive in the server.conf file altogether and restart the service?
And now the log will be handled exclusively by jornalctl?

2) Does no other services use journalctl and thus create the /var/log/journal
dir? If they do then (since they should have created the dir already) is the
sigle action needed to just remove the log directive from server.conf?
(and restart the openvpn service)?

3) On my openvpn server at home I have the same openvpn setup for the logging as
on the smaller remote servers and here I have just checked that there is a
/var/log/journal dir and it contains a single subdir named
60ef45f7ddcb44b69eb486e25a9b4894
So I have this and I don't know if that is a general logging dir or the one
openvpn server has created for journalctl...
What is it, how to find out?

4) On my main home server I have written a utility that lets me check which
clients are currently connected and this utility looks like this:

#!/bin/bash
#List active OpenVPN clients

CMDW="sudo cat /etc/openvpn/log/openvpn-status.log | grep CLIENT_LIST | sed -n
'1!p'"
CMDL="sudo cat /etc/openvpn/log/ovpn-status_local.log | grep CLIENT_LIST | sed
-n '1!p'"

echo -e "------------------------\nWeb access clients:"
eval "$CMDW"
echo -e "\nLocal access clients:"
eval "$CMDL"
echo "------------------------"

What is does is to list the currently connected clients such that I can choose a
service restart time when there are no active clients for instance.

But it uses the two status log files specified in the two server instances conf
files (I have one instance for using the VPN as a gateway into the Swedish
Internet and another to use only for local access to my home LAN).
Will this be affected if I remove the log directive?

TIA


-- 
Bo Berglund
Developer in Sweden