rsyslog forwarder ha #3

Supports: focal bionic xenial


Uses rsyslogs facilities to forward to multiple remote syslog servers.


This Charm provides support for adding a rsyslog forwarder listener to any service. In addition, this charm allows to have multiple rsyslog aggregators servers using two different replication modes ( fanout, failover ).

By default the 'fanout' replication mode is going to be used, which means that all the syslog messages will be forwarder to all aggregator servers.

Failover mode will forward all the syslog messages to the primary rsyslog server and in case of failure will use the secondary rsyslog server.

In you want to choose to failover mode, this will require that your current rsyslog server is binded to TCP port 514.

The charm can also optionally watch log files from apps which don't use syslog and forward those log entries also. By default it will watch apt and dpkg log files.

Usage method

This is a subordinate charm, which means it requires to have a service to hook in. On this example we are going to deploy mysql

juju deploy mysql

Then you must deploy this charm

juju deploy rsyslog-forwarder-ha

Once your service is running, you can relate this charm:

juju add-relation rsyslog-forwarder-ha mysql

Then you can deploy your rsyslog aggregators servers:

juju deploy rsyslog primary
juju deploy rsyslog secondary

Once your rsyslog aggregators are ready, you can relate them with your forwarder.

juju add-relation rsyslog-forwarder-ha primary
juju add-relation rsyslog-forwarder-ha secondary

Once you have your rsyslog ports opened. You can change the replication-mode variable on your rsyslog-forwarder-ha charm.

juju set rsyslog-forwarder-ha replication-mode="failover"

Contact Information



(string) TLS certificate in base64 format to access rsyslog server
(string) A comma-separated list of key=value representing hostname and ip address of servers to forward all logs to as in hostname1=host_ip1:port1,hostname2=host_ip2:port2,hostname3=host_ip3:port3 With no port specifed 514 will be used.
(boolean) Should logs be written locally as well as forwarded?
(string) Select messages to forward, in the form of <facility>.<severity> By default all messages are forwarded (*.*)
(string) Used by the nrpe-external-master subordinate charm. A string that will be prepended to instance name to set the host name in nagios. So for instance the hostname would be something like: juju-rsyslog-forwarder-ha-0 If you're running multiple environments with the same services in them this allows you to differentiate between them.
(string) A comma-separated list of nagios servicegroups. If left empty, the nagios_context will be used as the servicegroup
(string) transport protocol to use, currently supported options: udp, relp, tcp
(string) Possible options are 'fanout' or 'failover' fanout replicates the log messages over all the defined syslog relations, failover replicates the log messages just if the previous server is down. Failover always uses tcp for the protocol.
(string) A space separated list of files to follow with rsyslog imfile and forward to the aggregator. If set to empty string no files will be watched with imfile.
/var/log/dpkg.log /var/log/apt/history.log