SysLog Forwarding for XenServer

travisdh1

@DustinB3403 said in SysLog Forwarding for XenServer:

@travisdh1 said in SysLog Forwarding for XenServer:

For my XenServer (still 6.5), I actually started up the XenCenter app. Right click on the server -> properties -> click log destination on left -> click remote on right and enter the rsyslog server ip.

Which I've done that, but where on the syslog VM would I actually see the logs being created? What should I modify in the /var/lib/syslog.conf file on XenServer?

By default, everything goes in /var/log/messages. If you want to find things for just one host name

sudo cat /var/log/messages | grep 'hostname'

I'm now understanding why @scottalanmiller likes binary logs instead of ascii. That messages file grows quickly.

DustinB3403

@travisdh1 That does show a lot of information, which is scrolling very quickly!

I guess it works

DustinB3403

So if that works, then I need to setup a easy way to view these messages..

Is splunk the go to solution for this?

BRRABill

@DustinB3403 said in SysLog Forwarding for XenServer:

So if that works, then I need to setup a easy way to view these messages..

Is splunk the go to solution for this?

I used Splunk because it is free and easy. (For me.)

I tried setting up a few other things, and gave up. (Like loggly.) I want to get back to other logging stuff some day, but it works for me.

scottalanmiller

Splunk is free only for very small sizes. Once your logs grow or you have more than a few servers you normally overrun the free part.

DustinB3403

So what would be a good aggregation tool to be able to view the logs?

If Splunk stops at a tiny level..... I won't bother with it.

BRRABill

@DustinB3403 said in SysLog Forwarding for XenServer:

So what would be a good aggregation tool to be able to view the logs?

If Splunk stops at a tiny level..... I won't bother with it.

500MB per day.

DustinB3403

@BRRABill said in SysLog Forwarding for XenServer:

@DustinB3403 said in SysLog Forwarding for XenServer:

So what would be a good aggregation tool to be able to view the logs?

If Splunk stops at a tiny level..... I won't bother with it.

500MB per day.

yeah that's worthless......

BRRABill

@DustinB3403 said

yeah that's worthless......

Not for me!

BRRABill

@DustinB3403 said

yeah that's worthless......

You'll want to avoid logg.ly before someone recommends it, then. That is 200MB per day.

DustinB3403

So elk/logstash then?

Wasn't there a post around here by scott on how to set this up?

DustinB3403

Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

Danp

@DustinB3403 Maybe one of these?

DustinB3403

@Danp said in SysLog Forwarding for XenServer:

@DustinB3403 Maybe one of these?

I was actually just looking at that and Kibana...

I'm trying to determine if I can run it locally or if I need a DO account to do it...

scottalanmiller

@DustinB3403 said in SysLog Forwarding for XenServer:

Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

I'm pretty sure my walkthrough covers that.

DustinB3403

@scottalanmiller This one, correct?

scottalanmiller

@DustinB3403 said in SysLog Forwarding for XenServer:

@scottalanmiller This one, correct?

Yes

BRRABill

Let me know how it goes. I'd love to install another free server around here.

TAKE THAT MICROSOFT!

DustinB3403

I'm getting stuck at

  ./load.sh

with

Loading dashboards to http://localhost:9200 in .kibana
Loading search Cache-transactions:
curl: (7) Failed connect to localhost:9200; Connection timed out

DustinB3403

You know if I wasn't tired I would've noticed that @scottalanmiller made that a bash file.......