Skip to content

Rsyslog: Remove all logstash related configuration #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
quartje wants to merge 1 commit into
base: feature/component_info
Choose a base branch
from
Open

Rsyslog: Remove all logstash related configuration #112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions roles/common/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,13 +104,10 @@
tags: rsyslog

# Setup rsyslog
# Note: Default template requires a host in the "manage" group.
# If it's missing you get the error "AnsibleUndefinedVariable: list object has no element 0"
- name: Put rsyslog config
template: src='rsyslog/rsyslog.conf.j2' dest='/etc/rsyslog.conf'
notify: restart rsyslog
tags: rsyslog


# Include environment specific tasks
- include: "{{ inventory_dir }}/tasks/common.yml"
51 changes: 0 additions & 51 deletions roles/common/templates/rsyslog/rsyslog.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,14 +34,6 @@ module(load="impstats"
interval="600" # Every 10 minutes
severity="6") # Info

{# Run syslog RELP server on "manage" node #}
{% if 'manage' in group_names %}
# RELP input
$ModLoad imrelp
$InputRELPServerRun 10514
{% endif %}


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
Expand Down Expand Up @@ -70,17 +62,6 @@ $IMJournalStateFile imjournal.state
# Cleanup and compression is handled using cron jobs (not logrotate)
$template StepupAuthnFile,"/var/log/stepup-authentication-%$YEAR%-%$MONTH%-%$DAY%.log"

# Format for forwarding messages to rsyslog on loghost
# RSYSLOG_SyslogProtocol23Format is predefined like
# $template RSYSLOG_SyslogProtocol23Format,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
# Use newer RFC5424 syslog format that is natively understood by rsyslog.
# Disable %STRUCTURED-DATA% because this is difficult to parse in logstash
$template Forward_SyslogProtocol23Format,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% - %msg%\n"

# Format for forwarding messages from rsyslog on loghost to logstash on loghost
$template Logstash_SyslogProtocol23Format,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %msg%"


#### RULES ####

# Write stepup authentication messages to file
Expand All @@ -89,35 +70,6 @@ $template Logstash_SyslogProtocol23Format,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %
$ActionName local-stepup-authentication
if $programname == 'stepup-authentication' then ?StepupAuthnFile


{% if 'manage' in group_names %}
# Forward all messages to local logstash on localhost using RELP
$ModLoad omrelp
$ActionName omrelp-to-logstash
$ActionQueueType LinkedList # run asynchronously
$ActionQueueFileName omrelp-to-logstash # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries if host is down
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down

*.* :omrelp:127.0.0.1:20514;Logstash_SyslogProtocol23Format

# Discard all messages from other hosts
# This rule stops further processing of the rules below so messages from remote hosts will not be logged on the loghost
if $fromhost != '{{ inventory_hostname.split('.')[0] }}' then stop
{% elif loghost_relp_address != false %}
# Forward all messages to loghost using RELP
$ModLoad omrelp
$ActionName omrelp-to-loghost
$ActionQueueType LinkedList # run asynchronously
$ActionQueueFileName omrelp-to-loghost # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries if host is down
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
# Retry interval in seconds. the actual interval is (numRetries / 10 + 1) * $ActionResumeInterval.
$ActionResumeInterval 10

*.* :omrelp:{{ loghost_relp_address }}:{{ loghost_relp_port }};Forward_SyslogProtocol23Format
{% endif %}

# Log messages locally

# Log all kernel messages to the console.
Expand Down Expand Up @@ -153,7 +105,6 @@ uucp,news.crit /var/log/spooler
$ActionName local-log-boot
local7.* /var/log/boot.log


{% if rsyslog_remote_server is defined %}
# Forward all logs to the central logging server
module(load="omrelp")
Expand All @@ -174,5 +125,3 @@ action.resumeRetryCount="-1"
action.resumeInterval="5")
$PreserveFQDN on
{% endif %}