ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    SysLog Forwarding for XenServer

    IT Discussion
    rsyslog xenserver logging kibana elk elasticsearch
    10
    110
    24.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BRRABillB
      BRRABill @DustinB3403
      last edited by

      @DustinB3403 said in SysLog Forwarding for XenServer:

      @travisdh1 said in SysLog Forwarding for XenServer:

      For my XenServer (still 6.5), I actually started up the XenCenter app. Right click on the server -> properties -> click log destination on left -> click remote on right and enter the rsyslog server ip.

      Which I've done that, but where on the syslog VM would I actually see the logs being created? What should I modify in the /var/lib/syslog.conf file on XenServer?

      When I did that, I forwarded them to a VM running Splunk, and it showed right up.

      BRRABillB 1 Reply Last reply Reply Quote 1
      • BRRABillB
        BRRABill @BRRABill
        last edited by

        @BRRABill said

        When I did that, I forwarded them to a VM running Splunk, and it showed right up.

        In fact, I've done so much, I forgot to re-enable that. Just did, and it showed right up again.

        Just set the option in XC, and that was it. Immediately showed up in my Splunk install.

        8/12/16
        1:49:16.000 PM	
        Aug 12 13:49:16 10.0.4.20 Aug 11 13:49:37 xenserver-test-reinstall xapi: [debug|xenserver-test-reinstall|33 dbflush [/var/lib/xcp/state.db]||sql] XML backend [/var/lib/xcp/state.db] -- Write buffer flushed. Time: 0.020193
        host = 10.0.4.20 source = udp:514 sourcetype = linux_messages_syslog
        8/12/16
        1:49:14.000 PM	
        Aug 12 13:49:14 10.0.4.20 Aug 11 13:49:35 xenserver-test-reinstall xcp-rrdd-xenpm: [debug|xenserver-test-reinstall|0 ||xcp-rrdd-xenpm] Found 4 states; with 2 CPUs this means 2 states per CPU
        host = 10.0.4.20 source = udp:514 sourcetype = linux_messages_syslog
        8/12/16
        1:49:14.000 PM	
        Aug 12 13:49:14 10.0.4.20 Aug 11 13:49:35 xenserver-test-reinstall xcp-rrdd-xenpm: [debug|xenserver-test-reinstall|0 ||xcp-rrdd-xenpm] Process 3237 exited normally with code 0
        1 Reply Last reply Reply Quote 0
        • DustinB3403D
          DustinB3403
          last edited by

          So now I need a VM with splunk as well?

          Or can I use my CentOS Rsyslog Vm as well?

          1 Reply Last reply Reply Quote 0
          • travisdh1T
            travisdh1 @DustinB3403
            last edited by

            @DustinB3403 said in SysLog Forwarding for XenServer:

            @travisdh1 said in SysLog Forwarding for XenServer:

            For my XenServer (still 6.5), I actually started up the XenCenter app. Right click on the server -> properties -> click log destination on left -> click remote on right and enter the rsyslog server ip.

            Which I've done that, but where on the syslog VM would I actually see the logs being created? What should I modify in the /var/lib/syslog.conf file on XenServer?

            By default, everything goes in /var/log/messages. If you want to find things for just one host name

            sudo cat /var/log/messages | grep 'hostname'
            

            I'm now understanding why @scottalanmiller likes binary logs instead of ascii. That messages file grows quickly.

            DustinB3403D 1 Reply Last reply Reply Quote 1
            • DustinB3403D
              DustinB3403 @travisdh1
              last edited by

              @travisdh1 That does show a lot of information, which is scrolling very quickly!

              I guess it works

              1 Reply Last reply Reply Quote 0
              • DustinB3403D
                DustinB3403
                last edited by

                So if that works, then I need to setup a easy way to view these messages..

                Is splunk the go to solution for this?

                BRRABillB 1 Reply Last reply Reply Quote 0
                • BRRABillB
                  BRRABill @DustinB3403
                  last edited by BRRABill

                  @DustinB3403 said in SysLog Forwarding for XenServer:

                  So if that works, then I need to setup a easy way to view these messages..

                  Is splunk the go to solution for this?

                  I used Splunk because it is free and easy. 🙂 (For me.)

                  I tried setting up a few other things, and gave up. (Like loggly.) I want to get back to other logging stuff some day, but it works for me.

                  1 Reply Last reply Reply Quote 0
                  • scottalanmillerS
                    scottalanmiller
                    last edited by

                    Splunk is free only for very small sizes. Once your logs grow or you have more than a few servers you normally overrun the free part.

                    1 Reply Last reply Reply Quote 1
                    • DustinB3403D
                      DustinB3403
                      last edited by

                      So what would be a good aggregation tool to be able to view the logs?

                      If Splunk stops at a tiny level..... I won't bother with it.

                      BRRABillB 1 Reply Last reply Reply Quote 0
                      • BRRABillB
                        BRRABill @DustinB3403
                        last edited by

                        @DustinB3403 said in SysLog Forwarding for XenServer:

                        So what would be a good aggregation tool to be able to view the logs?

                        If Splunk stops at a tiny level..... I won't bother with it.

                        500MB per day.

                        DustinB3403D 1 Reply Last reply Reply Quote 0
                        • DustinB3403D
                          DustinB3403 @BRRABill
                          last edited by

                          @BRRABill said in SysLog Forwarding for XenServer:

                          @DustinB3403 said in SysLog Forwarding for XenServer:

                          So what would be a good aggregation tool to be able to view the logs?

                          If Splunk stops at a tiny level..... I won't bother with it.

                          500MB per day.

                          yeah that's worthless......

                          BRRABillB 2 Replies Last reply Reply Quote 0
                          • BRRABillB
                            BRRABill @DustinB3403
                            last edited by

                            @DustinB3403 said

                            yeah that's worthless......

                            Not for me! 🙂

                            1 Reply Last reply Reply Quote 0
                            • BRRABillB
                              BRRABill @DustinB3403
                              last edited by

                              @DustinB3403 said

                              yeah that's worthless......

                              You'll want to avoid logg.ly before someone recommends it, then. That is 200MB per day.

                              1 Reply Last reply Reply Quote 0
                              • DustinB3403D
                                DustinB3403
                                last edited by

                                So elk/logstash then?

                                Wasn't there a post around here by scott on how to set this up?

                                DanpD 1 Reply Last reply Reply Quote 1
                                • DustinB3403D
                                  DustinB3403
                                  last edited by

                                  Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

                                  scottalanmillerS 1 Reply Last reply Reply Quote 0
                                  • DanpD
                                    Danp @DustinB3403
                                    last edited by

                                    @DustinB3403 Maybe one of these?

                                    DustinB3403D 1 Reply Last reply Reply Quote 0
                                    • DustinB3403D
                                      DustinB3403 @Danp
                                      last edited by

                                      @Danp said in SysLog Forwarding for XenServer:

                                      @DustinB3403 Maybe one of these?

                                      I was actually just looking at that and Kibana...

                                      I'm trying to determine if I can run it locally or if I need a DO account to do it...

                                      1 Reply Last reply Reply Quote 0
                                      • scottalanmillerS
                                        scottalanmiller @DustinB3403
                                        last edited by

                                        @DustinB3403 said in SysLog Forwarding for XenServer:

                                        Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

                                        I'm pretty sure my walkthrough covers that.

                                        DustinB3403D 1 Reply Last reply Reply Quote 0
                                        • DustinB3403D
                                          DustinB3403 @scottalanmiller
                                          last edited by

                                          @scottalanmiller This one, correct?

                                          scottalanmillerS 1 Reply Last reply Reply Quote 0
                                          • scottalanmillerS
                                            scottalanmiller @DustinB3403
                                            last edited by

                                            @DustinB3403 said in SysLog Forwarding for XenServer:

                                            @scottalanmiller This one, correct?

                                            Yes

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 6
                                            • 1 / 6
                                            • First post
                                              Last post