Configuring local log storage
Local log storage on the SC//Reliant™ platform is configured through the profiles::rsyslog_server Puppet profile. This profile configures a node to store log messages locally on disk and, optionally, relay them to another server. For configuring a node to forward logs to destination servers, see Configuring log forwarding.
The rsyslog server profile is shared by two roles on the platform:
- Log containers. Typically configured to relay logs onward without storing them locally.
- Log servers (in cloud or co-located environments), typically configured to store logs locally.
The rsyslog client and rsyslog server profiles can be applied to the same node. When both are used together, profiles::rsyslog_client must be ordered before profiles::rsyslog_server in the Puppet profiles list.
Properties
The profiles::rsyslog_server profile uses the following node properties.
Storage and compression
| Property | Description | Default |
|---|---|---|
my_logserver_store_logs | When true, all logs are stored locally at /var/log/hosts/<hostname>. When false, the profile does not store logs and deletes existing log files under /var/log/hosts/<hostname>. Log containers should typically set this to false. Log servers should typically set this to true. | false |
my_rsyslog_compress_on_save | When true, log files are stored in GZip format as messages.gz. When false, files are stored as raw text as messages. Requires my_logserver_store_logs to be true to have any effect. When both compression and storage are enabled, the compress.sh cron job is disabled because log files are already compressed. | true |
Reading compressed log files
When logs are stored in GZip format, install the gztool package to tail compressed files directly. Running gztool -T messages.gz tails the logs in the same way tail -f would.
If gztool is not available, zcat combined with a loop command also works. For example:
watch -n 1 'zcat messages.gz | tail -n 20'Or:
while true; do zcat messages.gz | tail -n 20; doneRelay behavior
| Property | Description | Default |
|---|---|---|
my_logserver_relay | When true, the rsyslog server relays logs to another host. Relaying requires the rsyslog client profile (profiles::rsyslog_client) to also be applied. When false, logs are not forwarded and the log-rotation file at /var/log/hosts/messages is deleted. | true |
When relay is enabled, the host can forward logs to any destination. The forwarding uses a log stream represented by the file /var/log/hosts/messages. In log containers, this file can also be used for tailing application logs.
The size of the log stream is controlled by my_logserver_retention_size. This setting does not control the size of the per-host directories created when my_logserver_store_logs is enabled.
Retention
| Property | Description | Default |
|---|---|---|
my_logserver_retention_size | The size limit, in bytes, for the log rotation file. | 52428800 (50 MB) |
Listening ports
| Property | Description | Default |
|---|---|---|
my_logserver_tcp_port | Server TCP port number. | 514 |
my_logserver_udp_port | Server UDP port number. | 514 |
my_logserver_relp_port | Server RELP port number. | 5140 |