Log forwarding deployment examples

The following examples illustrate common rsyslog deployment patterns on the SC//Reliant™ platform. They combine the rsyslog client profile (see Configuring log forwarding) and the rsyslog server profile (see Configuring local log storage) to support typical multi-tier log architectures.

Typical use cases

Example 1: Edge nodes → log container → log server (storage only)

All rsyslog clients on the edge nodes (for example, red, eye, log, pay) send logs to a log container. The log container relays logs to a target log server. The log container does not store logs. The log server stores logs from all locations.

Node sit0001red0, edge node forwarding logs.

Profiles list:

• profiles::rsyslog_client

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logcontainer": {
        "host": "sit0001log0",
        "port": 5140
      }
    }
  }
}

Node sit0001log0, log container relaying to the log server.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: false

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logserver": {
        "host": "sitsrv0",
        "port": 5140
      }
    }
  }
}

Node sitsrv0, log server storing logs.

Profiles list:

• profiles::rsyslog_server

Node properties:

• my_logserver_relay: false
• my_logserver_store_logs: true

Example 2: Edge nodes → log container → log server (storage and 3rd-party forwarding)

Same topology as Example 1, but the log server now both stores logs locally and forwards them onward to a third-party service.

Node sit0001red0, edge node.

Profiles list:

• profiles::rsyslog_client

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logcontainer": {
        "host": "sit0001log0",
        "port": 5140
      }
    }
  }
}

Node sit0001log0, log container.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: false

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logserver": {
        "host": "sitsrv0",
        "port": 5140
      }
    }
  }
}

Node sitsrv0, log server with storage and onward forwarding.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: true

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "third-party-1": {
        "host": "host1",
        "port": 5140
      }
    }
  }
}

Example 3: Edge nodes → log container → log server with onward Elasticsearch forwarding

A log server that stores logs and forwards them to a third-party Elasticsearch.

Node sit0001red0, edge node.

Profiles list:

• profiles::rsyslog_client

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logcontainer": {
        "host": "sit0001log0",
        "port": 5140
      }
    }
  }
}

Node sit0001log0, log container.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: false

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logserver": {
        "host": "sitsrv0",
        "port": 5140
      }
    }
  }
}

Node sitsrv0, log server storing and forwarding to Elasticsearch.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: true

my_rsyslog_client:

{
  "elasticsearch_servers": {
    "elastic": {
      "server": "search-example.es.amazonaws.com",
      "logstash_index": "logstash-rsyslog",
      "port": 443
    }
  }
}

Additional supported permutations

The following examples illustrate other supported topologies.

A typical log container

Node sit0001red0, edge node.

Profiles list:

• profiles::rsyslog_client

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logcontainer": {
        "host": "sit0001log0",
        "port": 5140
      }
    }
  }
}

Node sit0001log0, log container that stores logs locally.

Profiles list:

• profiles::rsyslog_server

Node properties:

• my_logserver_relay: false
• my_logserver_store_logs: true

One server acting as both a relay and a storage server

Node sit0001red0, edge node.

Profiles list:

• profiles::rsyslog_client

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logcontainer": {
        "host": "sit0001log0",
        "port": 5140
      }
    }
  }
}

Node sit0001log0, both relay and storage.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: true

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logserver": {
        "host": "sitsrv0",
        "port": 5140
      }
    }
  }
}

Node sitsrv0, final storage destination.

Profiles list:

• profiles::rsyslog_server

Node properties:

• my_logserver_relay: false
• my_logserver_store_logs: true

One server forwarding to multiple servers

Node sit0001red0, edge node.

Profiles list:

• profiles::rsyslog_client

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logcontainer": {
        "host": "sit0001log0",
        "port": 5140
      }
    }
  }
}

Node sit0001log0, relay forwarding to two log servers.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: false

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logserver1": {
        "host": "sitsrv0",
        "port": 5140
      },
      "logserver2": {
        "host": "sitsrv1",
        "port": 5140
      }
    }
  }
}

Nodes sitsrv0 and sitsrv1, both storage destinations.

Profiles list:

• profiles::rsyslog_server

Node properties:

• my_logserver_relay: false
• my_logserver_store_logs: true

A chain of servers ending at a customer-owned log server

The rsyslog client forwards logs to a log container. The log container stores logs and forwards them to a log server owned by the operator. The operator's log server stores the logs and forwards them to a final log server owned by the customer.

Node sit0001red0, edge node.

Profiles list:

• profiles::rsyslog_client

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "logcontainer": {
        "host": "sit0001log0",
        "port": 5140
      }
    }
  }
}

Node sit0001log0, log container relaying onward.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: false

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "our-logserver": {
        "host": "sitsrv0",
        "port": 5140
      }
    }
  }
}

Node sitsrv0, operator-managed log server that stores and forwards to the customer's log server.

Profiles list:

• profiles::rsyslog_client
• profiles::rsyslog_server

Node properties:

• my_logserver_relay: true
• my_logserver_store_logs: true

my_rsyslog_client:

{
  "log_forwarders": {
    "servers": {
      "customer-logserver": {
        "host": "logserver.customer.com",
        "port": 5140
      }
    }
  }
}

Server logserver.customer.com, customer-owned destination. The customer owns this server and its configuration is not managed by the SC//Reliant platform. The server collects logs from sit0001red0, sit0001log0, sitsrv0, and any other customer-owned log sources.

Related documentation

• Managing logs
• Configuring log forwarding
• Configuring local log storage