rsyslog #18

Supports: focal bionic xenial trusty
Add to new model

Description

Rsyslog is a multi-threaded implementation of syslogd (a system utility providing support for message logging), with features that include:

  • reliable syslog over TCP, SSL/TLS and RELP
  • on-demand disk buffering
  • email alerting
  • writing to MySQL or PostgreSQL databases (via separate output plugins)
  • permitted sender lists
  • filtering on any part of the syslog message
  • on-the-wire message compression
  • fine-grained output format control
  • failover to backup destinations
  • enterprise-class encrypted syslog relaying

This is a simple rsyslogd logging server. It is most interesting when paired with the rsyslog-forwarder subordinate charm.

General

This charm provides support for setting up a simple rsyslogd logging server.

Usage method

On this example we are going to deploy mysql

juju deploy mysql

Then you must deploy this charm

juju deploy rsyslog primary-rsyslog

Then you can deploy a rsyslog-forwarder-ha charm, which will forward all the syslog messages from a specific service to this rsyslog server.

juju deploy rsyslog-forwarder-ha

Then relate both services

juju add-relation rsyslog-forwarder-ha mysql

Then you can deploy your rsyslog aggregators servers:

juju deploy rsyslog primary

Once your rsyslog aggregators are ready, you can relate them with your forwarder.

juju add-relation rsyslog-forwarder-ha primary-rsyslog

Once you have your rsyslog ports opened. You can change try this charm by running

juju ssh mysql/0

Then create a logger entry

mysql/0$ logger "testing"

Then see if the entry is being forwarded correctly:

juju ssh primary-rsyslog/0 
primary-rsyslog/0$ grep testing /var/log/syslog

Setting the protocol

By default rsyslog charms uses the UDP protocol, but also RELP or tcp can be used.

juju set rsyslog protocol="relp"
juju set rsyslog-forwarder-ha protocol="relp"

Forwarding logs to a system outside of the Juju environment

For forwarding within the Juju environment use the subordinate charm rsyslog-forwarder-ha but to forward the aggregated logs outside of the Juju environment you set the forward_* options.

juju set rsyslog forward_host="elk.my.domain"
juju set rsyslog forward_protocol="tcp"
juju set rsyslog forward_port="514"

Contact Information

Mantainer: rsyslog-charmers@lists.launchpad.net
Bugs: https://bugs.launchpad.net/rsyslog-charm

Configuration

forward_host
(string) A host to forward all logs to.
forward_options
(string) Options to add to the forward config, currently only used by RELP
forward_port
(string) The port on the forward_host to send logs to.
514
forward_protocol
(string) Transport protocol to use with the forward_host available options: udp, relp, tcp
tcp
forward_selector
(string) Syslog style selector to specify which logs to forward. For example '*.crit' or 'auth.*'
*.*
messages_rotate
(int) Number of days to rotate /var/log/messages and other associated files
4
nagios_context
(string) Used by the nrpe-external-master subordinate charm. A string that will be prepended to instance name to set the host name in nagios. So for instance the hostname would be something like: juju-rsyslog-0 If you're running multiple environments with the same services in them this allows you to differentiate between them.
juju
nagios_servicegroups
(string) A comma-separated list of nagios servicegroups. If left empty, the nagios_context will be used as the servicegroup
nova_logs
(boolean) Have an individual log file for each compute node as well as an aggregated log that contains nova logs from all nodes
protocol
(string) Transport protocol to use available options: udp, relp, tcp
udp
syslog_rotate
(int) Number of days to rotate /var/log/syslog file
7