Forward Logs to Syslog Server
You can configure fluentd
to send logs to a syslog server in addition
to Elasticsearch. This topic provides instructions for configuring fluentd
to
send logs to syslog compatible collectors. However, it only provides guidelines for the syslog
configuration, as syslog parameters differ by version. Knowledge of how to configure a syslog
compatible collector is required to complete this configuration.
Complete the following steps:
- Configure
fluentd
to send logs to the syslog server. - Configure
syslog
server to accept logs fromfluentd
.
Step 1: Configure fluentd to send logs to the syslog server
Complete the following steps on each fluentd
node.
- Open the
fluentd.conf
file (/opt/mapr/fluentd/fluentd-<version>/etc/fluentd/fluentd.conf). - Remove the # to uncomment the following store
section:
# <store> # @type remote_syslog # host 10.10.100.92 # port 51400 # severity debug # tag fluentd # </store>
- Update the
host
parameter to the hostname/IP address of the receivingsyslog
server. - Update the
port
parameter to match the port that the receivingsyslog
server is expecting remote logging information on. - Restart the
fluentd
service:maprcli node services -name fluentd -nodes <space separated list of hostname/IPaddresses> -action restart
NOTEYou can run this command after completing the steps on a node or run this command with a list of nodes once you have configured eachfluentd
node.
Step 2: Configure syslog to accept logs from fluentd
In general, you need to perform the following steps on the syslog
collection server:
- Configure
syslogd
to listen for logs outside of thesyslog
node. - Set up rules for how
syslog
handles the logs once it receives it.
- In /etc/rsyslog.d/listen.conf, comment out the following
parameter:
$SystemLogSocketName /run/systemd/journal/syslog
- In /etc/rsyslog.conf, uncomment the following properties:
#$ModLoad imudp #$UDPServerRun 514
- In /etc/rsyslog.conf, update the UDPServerRun to a value above 1000 that matches
the port you configured in fluentd.conf. For example:
Set UDPServerRun
to 51400 - In /etc/rsyslog.conf, configure rules for handling logs. For example, add the
following before the RULES section to route messages from the
fluentd
node to a log file named qa-node91.log.if $fromhost-ip == '10.10.100.91' then /var/log/qa-node91.log & ~
NOTEIn this example, the IP address must match the IP address of thefluentd
node.