ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    SysLog Forwarding for XenServer

    IT Discussion
    rsyslog xenserver logging kibana elk elasticsearch
    10
    110
    24.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DustinB3403D
      DustinB3403 @travisdh1
      last edited by

      @travisdh1 said in SysLog Forwarding for XenServer:

      For my XenServer (still 6.5), I actually started up the XenCenter app. Right click on the server -> properties -> click log destination on left -> click remote on right and enter the rsyslog server ip.

      Which I've done that, but where on the syslog VM would I actually see the logs being created? What should I modify in the /var/lib/syslog.conf file on XenServer?

      BRRABillB travisdh1T 2 Replies Last reply Reply Quote 0
      • BRRABillB
        BRRABill @DustinB3403
        last edited by

        @DustinB3403 said in SysLog Forwarding for XenServer:

        @travisdh1 said in SysLog Forwarding for XenServer:

        For my XenServer (still 6.5), I actually started up the XenCenter app. Right click on the server -> properties -> click log destination on left -> click remote on right and enter the rsyslog server ip.

        Which I've done that, but where on the syslog VM would I actually see the logs being created? What should I modify in the /var/lib/syslog.conf file on XenServer?

        When I did that, I forwarded them to a VM running Splunk, and it showed right up.

        BRRABillB 1 Reply Last reply Reply Quote 1
        • BRRABillB
          BRRABill @BRRABill
          last edited by

          @BRRABill said

          When I did that, I forwarded them to a VM running Splunk, and it showed right up.

          In fact, I've done so much, I forgot to re-enable that. Just did, and it showed right up again.

          Just set the option in XC, and that was it. Immediately showed up in my Splunk install.

          8/12/16
          1:49:16.000 PM	
          Aug 12 13:49:16 10.0.4.20 Aug 11 13:49:37 xenserver-test-reinstall xapi: [debug|xenserver-test-reinstall|33 dbflush [/var/lib/xcp/state.db]||sql] XML backend [/var/lib/xcp/state.db] -- Write buffer flushed. Time: 0.020193
          host = 10.0.4.20 source = udp:514 sourcetype = linux_messages_syslog
          8/12/16
          1:49:14.000 PM	
          Aug 12 13:49:14 10.0.4.20 Aug 11 13:49:35 xenserver-test-reinstall xcp-rrdd-xenpm: [debug|xenserver-test-reinstall|0 ||xcp-rrdd-xenpm] Found 4 states; with 2 CPUs this means 2 states per CPU
          host = 10.0.4.20 source = udp:514 sourcetype = linux_messages_syslog
          8/12/16
          1:49:14.000 PM	
          Aug 12 13:49:14 10.0.4.20 Aug 11 13:49:35 xenserver-test-reinstall xcp-rrdd-xenpm: [debug|xenserver-test-reinstall|0 ||xcp-rrdd-xenpm] Process 3237 exited normally with code 0
          1 Reply Last reply Reply Quote 0
          • DustinB3403D
            DustinB3403
            last edited by

            So now I need a VM with splunk as well?

            Or can I use my CentOS Rsyslog Vm as well?

            1 Reply Last reply Reply Quote 0
            • travisdh1T
              travisdh1 @DustinB3403
              last edited by

              @DustinB3403 said in SysLog Forwarding for XenServer:

              @travisdh1 said in SysLog Forwarding for XenServer:

              For my XenServer (still 6.5), I actually started up the XenCenter app. Right click on the server -> properties -> click log destination on left -> click remote on right and enter the rsyslog server ip.

              Which I've done that, but where on the syslog VM would I actually see the logs being created? What should I modify in the /var/lib/syslog.conf file on XenServer?

              By default, everything goes in /var/log/messages. If you want to find things for just one host name

              sudo cat /var/log/messages | grep 'hostname'
              

              I'm now understanding why @scottalanmiller likes binary logs instead of ascii. That messages file grows quickly.

              DustinB3403D 1 Reply Last reply Reply Quote 1
              • DustinB3403D
                DustinB3403 @travisdh1
                last edited by

                @travisdh1 That does show a lot of information, which is scrolling very quickly!

                I guess it works

                1 Reply Last reply Reply Quote 0
                • DustinB3403D
                  DustinB3403
                  last edited by

                  So if that works, then I need to setup a easy way to view these messages..

                  Is splunk the go to solution for this?

                  BRRABillB 1 Reply Last reply Reply Quote 0
                  • BRRABillB
                    BRRABill @DustinB3403
                    last edited by BRRABill

                    @DustinB3403 said in SysLog Forwarding for XenServer:

                    So if that works, then I need to setup a easy way to view these messages..

                    Is splunk the go to solution for this?

                    I used Splunk because it is free and easy. 🙂 (For me.)

                    I tried setting up a few other things, and gave up. (Like loggly.) I want to get back to other logging stuff some day, but it works for me.

                    1 Reply Last reply Reply Quote 0
                    • scottalanmillerS
                      scottalanmiller
                      last edited by

                      Splunk is free only for very small sizes. Once your logs grow or you have more than a few servers you normally overrun the free part.

                      1 Reply Last reply Reply Quote 1
                      • DustinB3403D
                        DustinB3403
                        last edited by

                        So what would be a good aggregation tool to be able to view the logs?

                        If Splunk stops at a tiny level..... I won't bother with it.

                        BRRABillB 1 Reply Last reply Reply Quote 0
                        • BRRABillB
                          BRRABill @DustinB3403
                          last edited by

                          @DustinB3403 said in SysLog Forwarding for XenServer:

                          So what would be a good aggregation tool to be able to view the logs?

                          If Splunk stops at a tiny level..... I won't bother with it.

                          500MB per day.

                          DustinB3403D 1 Reply Last reply Reply Quote 0
                          • DustinB3403D
                            DustinB3403 @BRRABill
                            last edited by

                            @BRRABill said in SysLog Forwarding for XenServer:

                            @DustinB3403 said in SysLog Forwarding for XenServer:

                            So what would be a good aggregation tool to be able to view the logs?

                            If Splunk stops at a tiny level..... I won't bother with it.

                            500MB per day.

                            yeah that's worthless......

                            BRRABillB 2 Replies Last reply Reply Quote 0
                            • BRRABillB
                              BRRABill @DustinB3403
                              last edited by

                              @DustinB3403 said

                              yeah that's worthless......

                              Not for me! 🙂

                              1 Reply Last reply Reply Quote 0
                              • BRRABillB
                                BRRABill @DustinB3403
                                last edited by

                                @DustinB3403 said

                                yeah that's worthless......

                                You'll want to avoid logg.ly before someone recommends it, then. That is 200MB per day.

                                1 Reply Last reply Reply Quote 0
                                • DustinB3403D
                                  DustinB3403
                                  last edited by

                                  So elk/logstash then?

                                  Wasn't there a post around here by scott on how to set this up?

                                  DanpD 1 Reply Last reply Reply Quote 1
                                  • DustinB3403D
                                    DustinB3403
                                    last edited by

                                    Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

                                    scottalanmillerS 1 Reply Last reply Reply Quote 0
                                    • DanpD
                                      Danp @DustinB3403
                                      last edited by

                                      @DustinB3403 Maybe one of these?

                                      DustinB3403D 1 Reply Last reply Reply Quote 0
                                      • DustinB3403D
                                        DustinB3403 @Danp
                                        last edited by

                                        @Danp said in SysLog Forwarding for XenServer:

                                        @DustinB3403 Maybe one of these?

                                        I was actually just looking at that and Kibana...

                                        I'm trying to determine if I can run it locally or if I need a DO account to do it...

                                        1 Reply Last reply Reply Quote 0
                                        • scottalanmillerS
                                          scottalanmiller @DustinB3403
                                          last edited by

                                          @DustinB3403 said in SysLog Forwarding for XenServer:

                                          Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

                                          I'm pretty sure my walkthrough covers that.

                                          DustinB3403D 1 Reply Last reply Reply Quote 0
                                          • DustinB3403D
                                            DustinB3403 @scottalanmiller
                                            last edited by

                                            @scottalanmiller This one, correct?

                                            scottalanmillerS 1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 6
                                            • 1 / 6
                                            • First post
                                              Last post