SysLog Forwarding for XenServer
-
@StrongBad said in SysLog Forwarding for XenServer:
They show up quickly. We're the logs pretty regular before the change?
With just a basic syslog server setup and forwarding enabled when I viewed /var/log/messages it was blowing by
-
-
-
I still have a few compressed logs (things that aren't marked to be forward to Elk/Kibana)
-
Obviously I'll need to change the syslog file to make sure those are only sent off host.
But why aren't they appearing in Elk/Kibana...
-
Everything here seems happy.
-
I still don't know why the logging isn't showing up in Kibana. . .
-
@DustinB3403 said in SysLog Forwarding for XenServer:
I still don't know why the logging isn't showing up in Kibana. . .
What do the local logs say? On both ends. There should be Logstash logs saying what has happened.
-
@scottalanmiller said in SysLog Forwarding for XenServer:
@DustinB3403 said in SysLog Forwarding for XenServer:
I still don't know why the logging isn't showing up in Kibana. . .
What do the local logs say? On both ends. There should be Logstash logs saying what has happened.
I'm still new to syslog, so what should I be looking at to answer this question?
-
You could just use Graylog. It uses rsyslog instead of file-beat (which doesn't work with journalctl anyway).
-
Since I'm having a hell of time getting this going, I setup a KiwI Syslog on a VM from one of my host, and it just works.
Just enabling the logging to the IP address, and let it go.
-
@DustinB3403 said in SysLog Forwarding for XenServer:
Since I'm having a hell of time getting this going, I setup a KiwI Syslog on a VM from one of my host, and it just works.
Just enabling the logging to the IP address, and let it go.
Instead of posting the logs to diagnose?
-
@scottalanmiller Again, where do I look for them....
-
@DustinB3403 said in SysLog Forwarding for XenServer:
@scottalanmiller Again, where do I look for them....
Check the logs.
(Boy I am glad I am not withing physical reach of you!
) -
My point with the Kiwi server is that I must've misconfigured something on the SysLog installation.
Since I've made no direct change other than the logging address in the XC settings. (which does update the settings in the server) but it doesn't change the default port etc.
-
@DustinB3403 said in SysLog Forwarding for XenServer:
@scottalanmiller Again, where do I look for them....
/var/log/messages same as always
-
@scottalanmiller said in SysLog Forwarding for XenServer:
@DustinB3403 said in SysLog Forwarding for XenServer:
@scottalanmiller Again, where do I look for them....
/var/log/messages same as always
... and what would be a decent way to view this as it breezes by at 100 lines a second?
Is there a specific event you're looking for?
-
@DustinB3403 said in SysLog Forwarding for XenServer:
@scottalanmiller said in SysLog Forwarding for XenServer:
@DustinB3403 said in SysLog Forwarding for XenServer:
@scottalanmiller Again, where do I look for them....
/var/log/messages same as always
... and what would be a decent way to view this as it breezes by at 100 lines a second?
Is there a specific event you're looking for?
It only breezes by if you tail it. Try just looking at it statically.
What is generating so many messages?
-
Looking for errors from the forwarder.
-
Have you tried? If you're seeing logs coming in from XenServer, then you should be on the right track.
tail -f|grep nameofsourceserver
