You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Init files: [remote_syslog.init.d](https://github.com/papertrail/remote_syslog2/blob/master/examples/remote_syslog.init.d) (init.d), OS X [launchd](https://github.com/papertrail/remote_syslog2/blob/master/examples/com.papertrailapp.remote_syslog.plist), [supervisor](https://github.com/papertrail/remote_syslog2/blob/master/examples/remote_syslog.supervisor.conf), Ubuntu [upstart](https://github.com/papertrail/remote_syslog2/blob/master/examples/remote_syslog.upstart.conf)
111
+
112
+
113
+
## Sending messages securely ##
114
+
115
+
If the receiving system supports sending syslog over TCP with TLS, you can
116
+
pass the `--tls` option when running `remote_syslog`:
`log_files.yml` has filenames to log from (as an array) and hostname and port
132
+
to log to (as a hash). Wildcards are supported using * and standard shell
133
+
globbing. Filenames given on the command line are additive to those in
134
+
the config file.
135
+
136
+
Only 1 destination server is supported; the command-line argument wins.
137
+
138
+
files:
139
+
- /var/log/httpd/access_log
140
+
- /var/log/httpd/error_log
141
+
- /var/log/mysqld.log
142
+
- /var/run/mysqld/mysqld-slow.log
143
+
destination:
144
+
host: logs.papertrailapp.com
145
+
port: 12345
146
+
protocol: tls
147
+
148
+
remote_syslog sends the name of the file without a path ("mysqld.log") as
149
+
the syslog tag (program name).
150
+
151
+
After changing the configuration file, restart `remote_syslog` using the
152
+
init script or by manually killing and restarting the process. For example:
153
+
154
+
/etc/init.d/remote_syslog restart
155
+
156
+
157
+
## Advanced Configuration (Optional)
158
+
159
+
Here's an [advanced config](https://github.com/papertrail/remote_syslog2/blob/master/examples/log_files.yml.example.advanced) which uses all options.
160
+
161
+
### Override hostname
162
+
163
+
Provide `--hostname somehostname` or use the `hostname` configuration option:
164
+
165
+
hostname: somehostname
166
+
167
+
168
+
### Detecting new files
169
+
170
+
remote_syslog automatically detects and activates new log files that match
171
+
its file specifiers. For example, `*.log` may be provided as a file specifier,
172
+
and remote_syslog will detect a `some.log` file created after it was started.
173
+
Globs are re-checked every 10 seconds.
174
+
175
+
Note: messages may be written to files in the 0-10 seconds between when the
176
+
file is created and when the periodic glob check detects it. This data is not
177
+
acted on.
178
+
179
+
If globs are specified on the command-line, enclose each one in single-quotes
180
+
(`'*.log'`) so the shell passes the raw glob string to remote_syslog (rather
181
+
than the current set of matches). This is not necessary for globs defined in
182
+
the config file.
183
+
184
+
185
+
### Log rotation
186
+
187
+
External log rotation scripts often move or remove an existing log file
188
+
and replace it with a new one (at a new inode). The Linux standard script
189
+
[logrotate](http://iain.cx/src/logrotate/) supports a `copytruncate` config
190
+
option. With that option, `logrotate` will copy files, operate on the copies,
191
+
and truncate the original so that the inode remains the same.
192
+
193
+
This comes closest to ensuring that programs watching these files (including
194
+
`remote_syslog`) will not be affected by, or need to be notified of, the
195
+
rotation. The only tradeoff of `copytruncate` is slightly higher disk usage
196
+
during rotation, so we recommend this option whether or not you use
197
+
`remote_syslog`.
198
+
199
+
200
+
### Excluding files from being sent
201
+
202
+
Provide one or more regular expressions to prevent certain files from being
203
+
matched.
204
+
205
+
exclude_files:
206
+
- \.\d$
207
+
- .bz2
208
+
- .gz
209
+
210
+
211
+
### Excluding lines matching a pattern
212
+
213
+
There may be certain log messages that you do not want to be sent. These may be
214
+
repetitive log lines that are "noise" that you might not be able to filter out
215
+
easily from the respective application. To filter these lines, use the
216
+
exclude_patterns with an array or regexes:
217
+
218
+
exclude_patterns:
219
+
- exclude this
220
+
- \d+ things
221
+
222
+
223
+
### Multiple instances
224
+
225
+
Run multiple instances to specify unique syslog hostnames.
226
+
227
+
To do that, provide an alternate PID path as a command-line option to the
228
+
additional instance(s). For example:
229
+
230
+
--pid-file=/var/run/remote_syslog_2.pid
231
+
232
+
Note: Daemonized programs use PID files to identify whether the program is already
233
+
running ([more](http://unix.stackexchange.com/questions/12815/what-are-pid-and-lock-files-for/12818#12818)). Like other daemons, remote_syslog will refuse to run as a
234
+
daemon (the default mode) when a PID file is present. If a .pid file is
235
+
present but the daemon is not actually running, remove the PID file.
236
+
237
+
### Choosing app name
238
+
239
+
remote_syslog uses the log file name (like "access_log") as the syslog
240
+
program name, or what the syslog RFCs call the "tag." This is ideal unless
241
+
remote_syslog watches many files that have the same name.
242
+
243
+
In that case, tell remote_syslog to set another program name by creating
244
+
symbolic link to the generically-named file:
245
+
246
+
cd /path/to/logs
247
+
ln -s generic_name.log unique_name.log
248
+
249
+
Point remote_syslog at unique_name.log. It will use that as the program name.
250
+
251
+
252
+
## Troubleshooting
253
+
254
+
When running remote_syslog in the foreground using the `-D` switch, if you
255
+
receive the error:
256
+
257
+
Error creating fsnotify watcher: inotify_init: too many open files
258
+
259
+
determine the maximum number of inotify instances that can be created using:
260
+
261
+
cat /proc/sys/fs/inotify/max_user_instances
262
+
263
+
and then increase this limit using:
264
+
265
+
echo VALUE >> /proc/sys/fs/inotify/max_user_instances
266
+
267
+
where VALUE is greater than the present setting. Confirm that remote_syslog starts
268
+
up and then apply this new value permanently by adding the following to
269
+
`/etc/sysctl.conf:`:
270
+
271
+
fs.inotify.max_user_instances = VALUE
272
+
273
+
69
274
## Reporting bugs
70
275
71
276
1. See whether the issue has already been reported: <https://github.com/papertrail/remote_syslog2/issues/>
0 commit comments