SysLog Forwarding for XenServer

scottalanmiller

Splunk is free only for very small sizes. Once your logs grow or you have more than a few servers you normally overrun the free part.

DustinB3403

So what would be a good aggregation tool to be able to view the logs?

If Splunk stops at a tiny level..... I won't bother with it.

BRRABill

@DustinB3403 said in SysLog Forwarding for XenServer:

So what would be a good aggregation tool to be able to view the logs?

If Splunk stops at a tiny level..... I won't bother with it.

500MB per day.

DustinB3403

@BRRABill said in SysLog Forwarding for XenServer:

@DustinB3403 said in SysLog Forwarding for XenServer:

So what would be a good aggregation tool to be able to view the logs?

If Splunk stops at a tiny level..... I won't bother with it.

500MB per day.

yeah that's worthless......

BRRABill

@DustinB3403 said

yeah that's worthless......

Not for me!

BRRABill

@DustinB3403 said

yeah that's worthless......

You'll want to avoid logg.ly before someone recommends it, then. That is 200MB per day.

DustinB3403

So elk/logstash then?

Wasn't there a post around here by scott on how to set this up?

DustinB3403

Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

Danp

@DustinB3403 Maybe one of these?

DustinB3403

@Danp said in SysLog Forwarding for XenServer:

@DustinB3403 Maybe one of these?

I was actually just looking at that and Kibana...

I'm trying to determine if I can run it locally or if I need a DO account to do it...

scottalanmiller

@DustinB3403 said in SysLog Forwarding for XenServer:

Has anyone setup syslog with Elk (with Elasticsearch 2.3 or greater) and Kibana

I'm pretty sure my walkthrough covers that.

DustinB3403

@scottalanmiller This one, correct?

scottalanmiller

@DustinB3403 said in SysLog Forwarding for XenServer:

@scottalanmiller This one, correct?

Yes

BRRABill

Let me know how it goes. I'd love to install another free server around here.

TAKE THAT MICROSOFT!

DustinB3403

I'm getting stuck at

  ./load.sh

with

Loading dashboards to http://localhost:9200 in .kibana
Loading search Cache-transactions:
curl: (7) Failed connect to localhost:9200; Connection timed out

DustinB3403

You know if I wasn't tired I would've noticed that @scottalanmiller made that a bash file.......

DustinB3403

Sadly the connection timed out still......

I might have to make a clean installation tomorrow and deal with it then. . . .

DustinB3403

And filebeat is not able to be found...

Ok coming back to this from my house where I can work with a beer..

scottalanmiller

Filebeat not found where?

DustinB3403

@scottalanmiller from this continuation here.

https://mangolassi.it/topic/8308/configuring-logstash-and-filebeat-to-send-to-elk-logging-system