Remote syslog server

43 views
Skip to first unread message

Marc Boisis

unread,
Nov 24, 2022, 2:59:34 AM11/24/22
to Flatcar Container Linux User
Hello,
I would like to export all flatcar logs to a remote syslog server (UDP 514).
How can I do this in flatcar ?
Marc

Kai Lüke

unread,
Nov 24, 2022, 5:48:40 AM11/24/22
to Marc Boisis, Flatcar Container Linux User
Hi,

I'm not sure about UDP but systemd-journald has ways to forward logs, too.
On one machine you start systemd-journal-gatewayd.socket and then the
collecting machine should be able to get it with "sudo systemd-run
--unit systemd-journal-remote-client
/usr/lib/systemd/systemd-journal-remote --url http://IPADDR:19531".
Reading entries can be done by filtering for the hostname "sudo
journalctl _HOSTNAME=gateway -t core --file
/var/log/journal/remote/remote-IPADDR.journal".
Now that is just the one-time action I copied from our test suite and
not a persistent setup nor in any way secured.
I'm sure that there are other ways, also for UDP - I didn't read the docs.
It's also possible to start extra software in a priv. container, too.
Jeremi or Vincent can maybe share more about a remote logging setup.

Regards,
Kai
> --
> You received this message because you are subscribed to the Google Groups "Flatcar Container Linux User" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to flatcar-linux-u...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/flatcar-linux-user/1dc4d42a-4fb6-4260-80e3-76a7a0f925e8n%40googlegroups.com.



--
Kinvolk GmbH | Adalbertstr.6a, 10999 Berlin | tel: +491755589364

Geschäftsführer/Directors: Benjamin Owen Orndorff

Registergericht/Court of registration: Amtsgericht Charlottenburg

Registernummer/Registration number: HRB 171414 B

Ust-ID-Nummer/VAT ID number: DE302207000

Marc Boisis

unread,
Nov 24, 2022, 6:21:49 AM11/24/22
to Flatcar Container Linux User
The weak point of systemd-journal-remote is the pull method from the centralized log-server.
To avoid missing logs, the push method from client to log-server is better, like "OLD" syslog protocol.

One idea could be a rsyslog docker running on flatcar, collecting journald messages and exporting them in UDP to the centralized  log-server.
What do you think about it ?
Marc

Jeremi Piotrowski

unread,
Nov 24, 2022, 8:43:59 AM11/24/22
to Flatcar Container Linux User
We have a remote logging setup running with rsyslog in a docker container, i can't provide you with an easy to replicate example but you need to:
- have something like this in your rsyslog.conf:

module(load="imuxsock"
 SysSock.Name="/run/systemd/journal/syslog")

- run the rsyslog container with `--privileged -v /run/systemd/journal:/run/systemd/journal`
- set `ForwardToSyslog=yes` in your /etc/systemd/journald.conf

With that, the rsyslog container should get all log messages from the machine and can process them or forward them elsewhere.

Bests,
Jeremi
Reply all
Reply to author
Forward
0 new messages