ROMAIN ROUGNY rrougny@vub.ac.be: Created page with "* All the configurations pertaining to rsyslog are in sites/.../config/rsyslog '''rsyslog.pan''' is handling the quattor filecopy of the conf files '''configs/*.conf''' ..."

2015-11-27T13:31:20Z

Created page with "* All the configurations pertaining to rsyslog are in sites/.../config/rsyslog ** '''rsyslog.pan''' is handling the quattor filecopy of the conf files ** '''configs/*.conf''' ..."

New page

* All the configurations pertaining to rsyslog are in sites/.../config/rsyslog
** '''rsyslog.pan''' is handling the quattor filecopy of the conf files
** '''configs/*.conf''' are the rsyslog conf file that indicate wich log file to forward
<br>
* We use the Module imfile. It is automatically loaded inside base.conf. Also, all syslog locals are forwarded to the log server in this file.
$ModLoad imfile
*.* @@log10.wn.iihe.ac.be:5544
<br>
* To add a specific file:
# You first need to create a conf file in configs/ , for instance myservice.conf:
$InputFileName /path/to/my/log.log # Complete path to the log file on the machine. Regex are not possible (so no *.log)
$InputFileTag myservice: # service name: will be stored into 'program' inside elk, for an easy grep.
$InputFileStateFile myservice_accounting # name of the state file (can be whatever). Just to store the file position for which rsyslog has already sent hte log lines.
$InputFileFacility local6 # Faclility. Unless you know hwat you want, local6 is fine. Anyway all locals are forwarded (in base.conf)
$InputRunFileMonitor # Add the file to the monitored ones using the variables you just set before.
:2. Then you need to make sure this myservice.conf will be copied to the machine(s) you want to inside its /etc/rsyslogd.d/ and the rsyslogd service is reloaded. For this, edit rsyslog.conf and add:
variable CONTENTS = file_contents('config/rsyslog/configs/myservice.conf'); # Loads the content of myservice.conf into CONTENTS
"/software/components/filecopy/services" = if( match(FULL_HOSTNAME,'^mymachine.iihe') ) return( # filecopy service + regex to match host name (optionnal)
npush(escape("/etc/rsyslog.d/myservice.conf"), # filename where to copy what's in CONTENTS
dict('config',CONTENTS , 'owner','root:root' , 'perms','0644' , 'restart','service rsyslog restart' ) ) ) else SELF; # Nothing to change

:3. You need to commit + runcheck, then the logs should appear on the kibana dashboard '''Logstash Search''' [http://log10.iihe.ac.be/index.html#/dashboard/elasticsearch/Logstash%20Search here]. To see your logs, type in the Query bar '''program: myservice''' .

Log forwarding with quattor - Revision history

ROMAIN ROUGNY rrougny@vub.ac.be: Created page with "* All the configurations pertaining to rsyslog are in sites/.../config/rsyslog ** '''rsyslog.pan''' is handling the quattor filecopy of the conf files ** '''configs/*.conf''' ..."

ROMAIN ROUGNY rrougny@vub.ac.be: Created page with "* All the configurations pertaining to rsyslog are in sites/.../config/rsyslog '''rsyslog.pan''' is handling the quattor filecopy of the conf files '''configs/*.conf''' ..."