ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    SysLog Forwarding for XenServer

    IT Discussion
    rsyslog xenserver logging kibana elk elasticsearch
    10
    110
    24.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      DustinB3403
      last edited by

      Ok so after playing with the timestamp (top right) I do actually have logs, but only from the 12th of the month...

      So maybe it was working, but not showing the logs... now to figure out what the crap is broken....

      1 Reply Last reply Reply Quote 1
      • M
        momurda
        last edited by

        I donwloaded the Graylog OVA this morning to test it out and put it on my XS pool. Just set Xencenter to forward logs to the Graylog server, seems to work well. Xenserver still making local log entries, but i am ok with that.
        Xenserver sure does like logging messages. 2 hosts making a couple hundred messages/minute, xenstored and xapi are the top ones by far.

        D B 2 Replies Last reply Reply Quote 2
        • D
          DustinB3403 @momurda
          last edited by

          @momurda said in SysLog Forwarding for XenServer:

          I donwloaded the Graylog OVA this morning to test it out and put it on my XS pool. Just set Xencenter to forward logs to the Graylog server, seems to work well. Xenserver still making local log entries, but i am ok with that.
          Xenserver sure does like logging messages. 2 hosts making a couple hundred messages/minute, xenstored and xapi are the top ones by far.

          What source are you using?

          1 Reply Last reply Reply Quote 0
          • M
            momurda
            last edited by

            All i did was download and import the ova, then went into Xencenter and forwarded logs on each host to the ip of the graylog server. Here is my sources page
            0_1471548705190_upload-f2c491d5-e547-43ae-bbe7-1cfaeb259539

            Here is more sources, basically the whole list. I am still quite overwhelmed with the options and config of graylog, but as i get dashboards setup for things and add more log sources i will post them here as well if you would like.

            0_1471548847262_upload-5fae783d-0560-4963-b4af-b4000cdc21b3

            1 Reply Last reply Reply Quote 1
            • M
              momurda
              last edited by

              I think it is important to note that the graylog ova is preconfigured to 'just work' according to their site, and it seems to do just that. I will try adding some of my windows vm to this and see what happens later today or tomorrow.

              B 1 Reply Last reply Reply Quote 1
              • D
                DustinB3403
                last edited by

                For some reason I thought / think there are some pretty big limitations to GrayLog.

                Maybe I'm wrong.... but I'll take a look at it.

                1 Reply Last reply Reply Quote 0
                • D
                  DustinB3403
                  last edited by

                  For anyone curious how to stop any local logging just modify

                  /var/lib/syslog.conf
                  

                  Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                  B 1 Reply Last reply Reply Quote 1
                  • B
                    BRRABill @DustinB3403
                    last edited by

                    @DustinB3403 said in SysLog Forwarding for XenServer:

                    For anyone curious how to stop any local logging just modify

                    /var/lib/syslog.conf
                    

                    Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                    Reboot and see if it sticks.

                    It did not for me.

                    D 1 Reply Last reply Reply Quote 0
                    • B
                      BRRABill @momurda
                      last edited by

                      @momurda said in SysLog Forwarding for XenServer:

                      I donwloaded the Graylog OVA this morning to test it out and put it on my XS pool.

                      I cannot get it to import onto my XS.

                      Did you just import it in with no issues?

                      B M 2 Replies Last reply Reply Quote 0
                      • D
                        DustinB3403 @BRRABill
                        last edited by

                        @BRRABill said in SysLog Forwarding for XenServer:

                        @DustinB3403 said in SysLog Forwarding for XenServer:

                        For anyone curious how to stop any local logging just modify

                        /var/lib/syslog.conf
                        

                        Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                        Reboot and see if it sticks.

                        It did not for me.

                        Will test tomorrow.

                        B 1 Reply Last reply Reply Quote 0
                        • B
                          BRRABill @DustinB3403
                          last edited by

                          @DustinB3403 said in SysLog Forwarding for XenServer:

                          @BRRABill said in SysLog Forwarding for XenServer:

                          @DustinB3403 said in SysLog Forwarding for XenServer:

                          For anyone curious how to stop any local logging just modify

                          /var/lib/syslog.conf
                          

                          Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                          Reboot and see if it sticks.

                          It did not for me.

                          Will test tomorrow.

                          That was my issue. On reboot it would wipe out the changes I made.

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            stacksofplates @BRRABill
                            last edited by

                            @BRRABill said in SysLog Forwarding for XenServer:

                            @DustinB3403 said in SysLog Forwarding for XenServer:

                            @BRRABill said in SysLog Forwarding for XenServer:

                            @DustinB3403 said in SysLog Forwarding for XenServer:

                            For anyone curious how to stop any local logging just modify

                            /var/lib/syslog.conf
                            

                            Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                            Reboot and see if it sticks.

                            It did not for me.

                            Will test tomorrow.

                            That was my issue. On reboot it would wipe out the changes I made.

                            In a pinch you can do chattr +i on the rsyslog.conf file to make it immutable.

                            B 1 Reply Last reply Reply Quote 0
                            • B
                              BRRABill @stacksofplates
                              last edited by

                              @stacksofplates said in SysLog Forwarding for XenServer:

                              @BRRABill said in SysLog Forwarding for XenServer:

                              @DustinB3403 said in SysLog Forwarding for XenServer:

                              @BRRABill said in SysLog Forwarding for XenServer:

                              @DustinB3403 said in SysLog Forwarding for XenServer:

                              For anyone curious how to stop any local logging just modify

                              /var/lib/syslog.conf
                              

                              Comment out everything that hits a local path, leaving the @<ip_addr> as the only option.

                              Reboot and see if it sticks.

                              It did not for me.

                              Will test tomorrow.

                              That was my issue. On reboot it would wipe out the changes I made.

                              In a pinch you can do chattr +i on the rsyslog.conf file to make it immutable.

                              Yeah on the bottom of that article everyone talks about it basically says to change the permission to make it unwritable.

                              But they call that a QUOTE dirty, dirty tirck UNQUOTE.

                              1 Reply Last reply Reply Quote 0
                              • B
                                BRRABill @BRRABill
                                last edited by

                                @BRRABill said in SysLog Forwarding for XenServer:

                                @momurda said in SysLog Forwarding for XenServer:

                                I donwloaded the Graylog OVA this morning to test it out and put it on my XS pool.

                                I cannot get it to import onto my XS.

                                Did you just import it in with no issues?

                                I tried on my other XS and it worked fine.

                                Must have been a memory issue on my test one.

                                1 Reply Last reply Reply Quote 0
                                • B
                                  BRRABill @momurda
                                  last edited by

                                  @momurda said in SysLog Forwarding for XenServer:

                                  I think it is important to note that the graylog ova is preconfigured to 'just work' according to their site, and it seems to do just that. I will try adding some of my windows vm to this and see what happens later today or tomorrow.

                                  Once I had it imported onto my XS, I had it logging in seconds.

                                  Pretty sweet.

                                  If only I was using open source and virtualization years ago!!!!!!

                                  1 Reply Last reply Reply Quote 2
                                  • M
                                    momurda @BRRABill
                                    last edited by

                                    @BRRABill
                                    Yes, no issues. Didn't even use the fixup disc option. Took a few minutes to start up but it worked right away

                                    B 1 Reply Last reply Reply Quote 0
                                    • B
                                      BRRABill @momurda
                                      last edited by

                                      @momurda said in SysLog Forwarding for XenServer:

                                      @BRRABill
                                      Yes, no issues. Didn't even use the fixup disc option. Took a few minutes to start up but it worked right away

                                      Yep, pretty sweet indeed.

                                      When I get some time I'm going to forward all my Windows event logs there.

                                      scottalanmillerS 1 Reply Last reply Reply Quote 0
                                      • scottalanmillerS
                                        scottalanmiller @BRRABill
                                        last edited by

                                        @BRRABill said in SysLog Forwarding for XenServer:

                                        @momurda said in SysLog Forwarding for XenServer:

                                        @BRRABill
                                        Yes, no issues. Didn't even use the fixup disc option. Took a few minutes to start up but it worked right away

                                        Yep, pretty sweet indeed.

                                        When I get some time I'm going to forward all my Windows event logs there.

                                        You've got GrayLog2 working now?

                                        B 1 Reply Last reply Reply Quote 0
                                        • B
                                          BRRABill @scottalanmiller
                                          last edited by

                                          @scottalanmiller said in SysLog Forwarding for XenServer:

                                          @BRRABill said in SysLog Forwarding for XenServer:

                                          @momurda said in SysLog Forwarding for XenServer:

                                          @BRRABill
                                          Yes, no issues. Didn't even use the fixup disc option. Took a few minutes to start up but it worked right away

                                          Yep, pretty sweet indeed.

                                          When I get some time I'm going to forward all my Windows event logs there.

                                          You've got GrayLog2 working now?

                                          Yeah it was super simple.

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            BRRABill
                                            last edited by

                                            I am the new King of Open Source.

                                            dafyreD 1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 6
                                            • 6 / 6
                                            • First post
                                              Last post