Adarsh
Adarsh

Reputation: 3573

syslog measurement not appearing in influxdb

TL;DR Not able to see syslog logs in influxdb

Environment:

OS: mac os mojave
telegraf version: 1.8
influxdb version: 1.6.4

So I wanted to view logs in chronograf and figured out from the set of input plugins offered in telegraf to use the syslog plugin.

I have followed the instructions here, but have added the steps here too for easy read.

I installed rsyslog via homebrew as follows:

$ brew install rsyslog

Added the following in /usr/local/etc/rsyslog.conf:

$WorkDirectory /tmp/rsyslog # temporary directory for storing data 
$ActionQueueType LinkedList # use asynchronous processing 
$ActionQueueFileName srvrfwd # set file name, also enables disk mode 
$ActionResumeRetryCount -1 # infinite retries on insert failure 
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down 
$ModLoad imudp #loads the udp module 
#listen for messages on udp localhost:514 
$UDPServerAddress localhost 
$UDPServerRun 514 
*.* @@(o)127.0.0.1:6514;RSYSLOG_SyslogProtocol23Format

restarted rsyslog:

$ sudo brew services restart rsyslog

I configured telegraf as follows:

# # Accepts syslog messages per RFC5425
 [[inputs.syslog]]
#   ## Specify an ip or hostname with port - eg., tcp://localhost:6514, tcp://10.0.0.1:6514
#   ## Protocol, address and port to host the syslog receiver.
#   ## If no host is specified, then localhost is used.
#   ## If no port is specified, 6514 is used (RFC5425#section-4.1).
 server = "tcp://localhost:6514"

and restarted telegraf as follows:

$ brew services restart telegraf

But my expectation was to see syslog measurement inside of telegrafdatabase

I wrote the following python script to log to syslog hoping that it would appear in the database:

import logging
import logging.handlers

my_logger = logging.getLogger('MyLogger')
my_logger.setLevel(logging.DEBUG)

handler = logging.handlers.SysLogHandler(address='/var/run/syslog')

my_logger.addHandler(handler)

my_logger.debug('this is debug')
my_logger.critical('this is critical')

but to no avail.

What could be wrong here? If so is there a log file I could check in?

EDIT 1:

So I troubleshooted rsyslog using the rsyslogd -N1 command and found some issues:

After doing all the above I restarted rsyslog and also influxdb and telegraf and checked again if there were any errors by running the rsyslogd -N1 command and the following is the output:

rsyslogd: version 8.37.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

Still the same issue persists.

EDIT 2: related post: syslog-plugin-from-remote-server

Upvotes: 1

Views: 1241

Answers (0)

Related Questions