Syslog Source

문서 > Observability Pipelines > Sources > Syslog Source

이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

이용 가능:

Logs

Use Observability Pipelines’ rsyslog or syslog-ng to receive logs sent to rsyslog or syslog-ng. Select and set up this source when you set up a pipeline.

You can also forward third-party log to syslog and then send them to the Observability Pipelines Worker.

Prerequisites

To use Observability Pipelines’ Syslog source, your applications must be sending data in one of the following formats: RFC 6587, RFC 5424, RFC 3164. You also need to have the following information available:

The bind address that your Observability Pipelines Worker (OPW) will listen on to receive logs from your applications. For example, 0.0.0.0:8088. Later on, you configure your applications to send logs to this address.
The appropriate TLS certificates and the password you used to create your private key if your forwarders are globally configured to enable SSL.

Set up the source in the pipeline UI

Select and set up this source when you set up a pipeline. The information below is for the source settings in the pipeline UI.

To configure your Syslog source:

Only enter the identifiers for the syslog address and, if applicable, the TLS key pass. Do not enter the actual values.

Enter the identifier for your syslog address. If you leave it blank, the default is used.
In the Socket Type dropdown menu, select the communication protocol you want to use: TCP or UDP.

Optional settings

Toggle the switch to Enable TLS. If you enable TLS, the following certificate and key files are required.
Note: All file paths are made relative to the configuration data directory, which is /var/lib/observability-pipelines-worker/config/ by default. See Advanced Worker Configurations for more information. The file must be owned by the observability-pipelines-worker group and observability-pipelines-worker user, or at least readable by the group or user.

Enter the identifier for your syslog key pass. If you leave it blank, the default is used.
Server Certificate Path: The path to the certificate file that has been signed by your Certificate Authority (CA) root file in DER or PEM (X.509) format.
CA Certificate Path: The path to the certificate file that is your Certificate Authority (CA) root file in DER or PEM (X.509) format.
Private Key Path: The path to the .key private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.

Set secrets

These are the defaults used for secret identifiers and environment variables.

Note: If you enter identifiers for your secrets and then choose to use environment variables, the environment variable is the identifier entered and prepended with DD_OP. For example, if you entered PASSWORD_1 for a password identifier, the environment variable for that password is DD_OP_PASSWORD_1.

rsyslog or syslog-ng address identifier:
- References the bind address, such 0.0.0.0:9997, on which the Observability Pipelines Worker listens to receive logs from the Syslog forwarder.
- The default identifier is SOURCE_SYSLOG_ADDRESS.
rsyslog or syslog-ng TLS passphrase identifier (when TLS is enabled):
- The default identifier is SOURCE_SYSLOG_KEY_PASS.

rsyslog or syslog-ng address:
- The Observability Pipelines Worker listens on this bind address to receive logs from the Syslog forwarder. For example, 0.0.0.0:9997.
- The default environment variable is DD_OP_SOURCE_SYSLOG_ADDRESS.
rsyslog or syslog-ng TLS passphrase (when enabled):
- The default environment variable is DD_OP_SOURCE_SYSLOG_KEY_PASS.

Send logs to the Observability Pipelines Worker over syslog

rsyslog

To send rsyslog logs to the Observability Pipelines Worker, update your rsyslog config file:

ruleset(name="infiles") {
action(type="omfwd" protocol="tcp" target="<OPW_HOST>" port="<OPW_PORT>")
}

<OPW_HOST> is the IP/URL of the host (or load balancer) associated with the Observability Pipelines Worker.

For CloudFormation installs, the LoadBalancerDNS CloudFormation output has the correct URL to use.
For Kubernetes installs, the internal DNS record of the Observability Pipelines Worker service can be used, for example opw-observability-pipelines-worker.default.svc.cluster.local.

syslog-ng

To send syslog-ng logs to the Observability Pipelines Worker, update your syslog-ng config file:

destination obs_pipelines {
  http(
      url("<OPW_HOST>")
      method("POST")
      body("﹤${PRI}>1 ${ISODATE} ${HOST:--} ${PROGRAM:--} ${PID:--} ${MSGID:--} ${SDATA:--} $MSG\n")
  );
};