Skip to content

Commit 7188992

Browse files
jmene442git-thuerk-doneestherk15
authored
Redrafting Rsyslog integration to adjust intake to HTTP over TCP (#32564)
* Redrafting Rsyslog integration to adjust intake to HTTP over TCP * Merge same content, remove tls options (#33240) --------- Co-authored-by: Alicia Thuerk <[email protected]> Co-authored-by: Esther Kim <[email protected]>
1 parent 3cfc68b commit 7188992

File tree

1 file changed

+7
-347
lines changed

1 file changed

+7
-347
lines changed

‎content/en/integrations/rsyslog.md‎

Lines changed: 7 additions & 347 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ further_reading:
2222
- link: "https://www.datadoghq.com/architecture/using-rsyslog-to-send-logs-to-datadog/"
2323
tag: "Architecture Center"
2424
text: "Using Rsyslog to send logs to Datadog"
25+
- link: "/logs/log_collection/?tab=host#logging-endpoints"
26+
tag: "Documentation"
27+
text: "Log Collection and Integrations"
28+
- link: "https://docs.datadoghq.com/data_security/logs/"
29+
tag: "Documentation"
30+
text: "Log Management Data Security"
31+
2532
---
2633

2734
## Overview
@@ -32,13 +39,8 @@ Configure Rsyslog to gather logs from your host, containers, and services.
3239

3340
### Log collection
3441

35-
#### Rsyslog version >=8
3642
<div class="alert alert-info"> From <a href="https://www.rsyslog.com/doc/configuration/modules/imfile.html#mode">version 8.1.5</a> Rsyslog recommends <code>inotify</code> mode. Traditionally, <code>imfile</code> used polling mode, which is much more resource-intense (and slower) than <code>inotify</code> mode. </div>
3743

38-
{{< tabs >}}
39-
40-
{{% tab "Ubuntu and Debian" %}}
41-
4244
1. Activate the `imfile` module to monitor specific log files. To add the `imfile` module, add the following to your `rsyslog.conf`:
4345

4446
```conf
@@ -47,26 +49,6 @@ Configure Rsyslog to gather logs from your host, containers, and services.
4749
4850
2. Create an `/etc/rsyslog.d/datadog.conf` file.
4951
50-
{{< site-region region="us,eu" >}}
51-
52-
3. In `/etc/rsyslog.d/datadog.conf`, add the following configuration and replace `<site_url>` with **{{< region-param key="dd_site" >}}** and `<API_KEY>` with your Datadog API key. You must include a separate `input` line for each log file you want to monitor:
53-
54-
```conf
55-
## For each file to send
56-
input(type="imfile" ruleset="infiles" Tag="<APP_NAME_OF_FILE1>" File="<PATH_TO_FILE1>")
57-
58-
## Set the Datadog Format to send the logs
59-
$template DatadogFormat,"<DATADOG_API_KEY> <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - - %msg%\n"
60-
61-
ruleset(name="infiles") {
62-
action(type="omfwd" protocol="tcp" target="intake.logs.<site_url>" port="10514" template="DatadogFormat")
63-
}
64-
```
65-
66-
{{< /site-region >}}
67-
68-
{{< site-region region="us3,us5,ap1,gov" >}}
69-
7052
3. In `/etc/rsyslog.d/datadog.conf`, add the following configuration. Replace `<site_url>` with **{{< region-param key="dd_site" >}}** and `<API_KEY>` with your Datadog API key. You must include a separate `input` line for each log file you want to monitor:
7153
7254
```conf
@@ -83,7 +65,6 @@ Configure Rsyslog to gather logs from your host, containers, and services.
8365
action(type="omhttp" server="http-intake.logs.<site_url>" serverport="443" restpath="api/v2/logs" template="test_template" httpheaders=["DD-API-KEY: <API_KEY>", "Content-Type: application/json"])
8466
}
8567
```
86-
{{< /site-region >}}
8768

8869
4. Restart Rsyslog. Your new logs are forwarded directly to your Datadog account.
8970
```shell
@@ -127,327 +108,6 @@ Configure Rsyslog to gather logs from your host, containers, and services.
127108
sudo systemctl restart rsyslog
128109
```
129110
130-
{{% site-region region="us" %}}
131-
8. (Optional) Add TLS Encryption to logs sent from Rsyslog to your Datadog account.
132-
1. Install the `rsyslog-gnutls` and `ca-certificates` packages:
133-
```shell
134-
sudo apt-get install rsyslog-gnutls ca-certificates
135-
```
136-
2. Add the following line to the bottom of your `/etc/rsyslog.d/datadog.conf` file:
137-
```conf
138-
## Define the destination for the logs
139-
$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-certificates.crt
140-
ruleset(name="infiles") {
141-
action(type="omfwd" protocol="tcp" target="intake.logs.datadoghq.com" port="10516" template="DatadogFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.datadoghq.com" )
142-
}
143-
```
144-
3. Restart the Rsyslog service:
145-
146-
```shell
147-
sudo systemctl restart rsyslog
148-
```
149-
{{% /site-region %}}
150-
{{% site-region region="eu" %}}
151-
152-
8. (Optional) Add TLS Encryption to logs sent from Rsyslog to your Datadog account.
153-
1. Install the `rsyslog-gnutls` and `ca-certificates` packages:
154-
```shell
155-
sudo apt-get install rsyslog-gnutls ca-certificates
156-
```
157-
158-
2. Add the following line to the bottom of your `/etc/rsyslog.d/datadog.conf` file:
159-
```conf
160-
## Define the destination for the logs
161-
$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-certificates.crt
162-
ruleset(name="infiles") {
163-
action(type="omfwd" protocol="tcp" target="tcp-intake.logs.datadoghq.eu" port="443" template="DatadogFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.datadoghq.eu" )
164-
}
165-
```
166-
3. Restart the Rsyslog service:
167-
168-
```shell
169-
sudo systemctl restart rsyslog
170-
```
171-
{{% /site-region %}}
172-
173-
[1]: /agent/logs/
174-
{{% /tab %}}
175-
176-
{{% tab "Amazon Linux, CentOS, and Red Hat" %}}
177-
1. Activate the `imfile` module to monitor specific log files. To add the `imfile` module, add the following to your `rsyslog.conf`:
178-
179-
```conf
180-
module(load="imfile" PollingInterval="10") #needs to be done just once
181-
```
182-
183-
2. Create an `/etc/rsyslog.d/datadog.conf` file.
184-
185-
{{< site-region region="us,eu" >}}
186-
187-
3. In `/etc/rsyslog.d/datadog.conf`, add the following configuration and replace `<site_url>` with **{{< region-param key="dd_site" >}}** and `<API_KEY>` with your Datadog API key. You must include a separate `input` line for each log file you want to monitor:
188-
189-
```conf
190-
## For each file to send
191-
input(type="imfile" ruleset="infiles" Tag="<APP_NAME_OF_FILE1>" File="<PATH_TO_FILE1>")
192-
193-
## Set the Datadog Format to send the logs
194-
$template DatadogFormat,"<DATADOG_API_KEY> <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - - %msg%\n"
195-
196-
ruleset(name="infiles") {
197-
action(type="omfwd" protocol="tcp" target="intake.logs.<site_url>" port="10514" template="DatadogFormat")
198-
}
199-
```
200-
201-
{{< /site-region >}}
202-
203-
{{< site-region region="us3,us5,ap1,gov" >}}
204-
205-
3. In `/etc/rsyslog.d/datadog.conf`, add the following configuration. Replace `<site_url>` with **{{< region-param key="dd_site" >}}** and `<API_KEY>` with your Datadog API key. You must include a separate `input` line for each log file you want to monitor:
206-
207-
```conf
208-
## For each file to send
209-
input(type="imfile" ruleset="infiles" Tag="<TAGS>" File="<PATH_TO_FILE1>")
210-
211-
## Set the Datadog Format to send the logs
212-
template(name="test_template" type="list") { constant(value="{") property(name="msg" outname="message" format="jsonfr") constant(value="}")}
213-
214-
# include the omhttp module
215-
module(load="omhttp")
216-
217-
ruleset(name="infiles") {
218-
action(type="omhttp" server="http-intake.logs.<site_url>" serverport="443" restpath="api/v2/logs" template="test_template" httpheaders=["DD-API-KEY: <API_KEY>", "Content-Type: application/json"])
219-
}
220-
```
221-
{{< /site-region >}}
222-
223-
4. Restart Rsyslog. Your new logs are forwarded directly to your Datadog account.
224-
```shell
225-
sudo systemctl restart rsyslog
226-
```
227-
228-
5. Associate your logs with the host metrics and tags:
229-
230-
To make sure that your logs are associated with the metrics and tags from the same host in your Datadog account, set the `HOSTNAME` in your `rsyslog.conf` to match the hostname of your Datadog metrics.
231-
- If you specified a hostname in `datadog.conf` or `datadog.yaml`, replace the `%HOSTNAME%` value in `rsyslog.conf` to match your hostname.
232-
- If you did not specify a hostname in `datadog.conf` or `datadog.yaml`, you do not need to change anything.
233-
234-
6. To get the best use out of your logs in Datadog, set a source for the logs.
235-
- If you [forward your logs to the Datadog Agent][1], you can set the source in the Agent configuration file.
236-
- If you're not forwarding your logs to the Datadog Agent, create a distinct configuration file for each source in `/etc/rsyslog.d/`:
237-
238-
To set the source, use the following format (if you have several sources, change the name of the format in each file):
239-
240-
```conf
241-
$template DatadogFormat,"<DATADOG_API_KEY> <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - [metas ddsource=\"<MY_SOURCE_NAME>\"] %msg%\n"
242-
```
243-
244-
You can add custom tags with the `ddtags` attribute:
245-
246-
```conf
247-
$template DatadogFormat,"<DATADOG_API_KEY> <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - [metas ddsource=\"<MY_SOURCE_NAME>\" ddtags=\"env:dev,<KEY:VALUE>\"] %msg%\n"
248-
```
249-
250-
7. (Optional) Datadog cuts inactive connections after a period of inactivity. Some versions of Rsyslog are not able to reconnect when necessary. To mitigate this issue, use time markers so the connection never stops:
251-
252-
1. Add the following two lines to your Rsyslog configuration file:
253-
254-
```conf
255-
$ModLoad immark
256-
$MarkMessagePeriod 20
257-
```
258-
259-
2. Restart the Rsyslog service:
260-
261-
```shell
262-
sudo systemctl restart rsyslog
263-
```
264-
265-
{{% site-region region="us" %}}
266-
8. (Optional) Add TLS Encryption to logs sent from Rsyslog to your Datadog account.
267-
1. Install the `rsyslog-gnutls` and `ca-certificates` packages:
268-
```shell
269-
sudo yum install rsyslog-gnutls ca-certificates
270-
```
271-
2. Add the following line to the bottom of your `/etc/rsyslog.d/datadog.conf` file:
272-
```conf
273-
## Define the destination for the logs
274-
$DefaultNetstreamDriverCAFile /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
275-
ruleset(name="infiles") {
276-
action(type="omfwd" protocol="tcp" target="intake.logs.datadoghq.com" port="10516" template="DatadogFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.datadoghq.com" )
277-
}
278-
```
279-
3. Restart the Rsyslog service:
280-
281-
```shell
282-
sudo systemctl restart rsyslog
283-
```
284-
{{% /site-region %}}
285-
286-
{{% site-region region="eu" %}}
287-
288-
8. (Optional) Add TLS Encryption to logs sent from Rsyslog to your Datadog account:
289-
1. Install the `rsyslog-gnutls` and `ca-certificates` packages:
290-
```shell
291-
sudo yum install rsyslog-gnutls ca-certificates
292-
```
293-
294-
2. Add the following line to the bottom of your `/etc/rsyslog.d/datadog.conf` file:
295-
```conf
296-
## Define the destination for the logs
297-
$DefaultNetstreamDriverCAFile /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
298-
ruleset(name="infiles") {
299-
action(type="omfwd" protocol="tcp" target="tcp-intake.logs.datadoghq.eu" port="443" template="DatadogFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.datadoghq.eu" )
300-
}
301-
```
302-
3. Restart the Rsyslog service:
303-
304-
```shell
305-
sudo systemctl restart rsyslog
306-
```
307-
{{% /site-region %}}
308-
309-
[1]: /agent/logs/
310-
{{% /tab %}}
311-
312-
{{% tab "Fedora" %}}
313-
1. Activate the `imfile` module to monitor specific log files. To add the `imfile` module, add the following to your `rsyslog.conf`:
314-
315-
```conf
316-
module(load="imfile" PollingInterval="10") #needs to be done just once
317-
```
318-
319-
2. Create an `/etc/rsyslog.d/datadog.conf` file.
320-
321-
322-
{{< site-region region="us,eu" >}}
323-
324-
3. In `/etc/rsyslog.d/datadog.conf`, add the following configuration and replace `<site_url>` with **{{< region-param key="dd_site" >}}** and `<API_KEY>` with your Datadog API key. You must include a separate `input` line for each log file you want to monitor:
325-
326-
```conf
327-
## For each file to send
328-
input(type="imfile" ruleset="infiles" Tag="<APP_NAME_OF_FILE1>" File="<PATH_TO_FILE1>")
329-
330-
## Set the Datadog Format to send the logs
331-
$template DatadogFormat,"<DATADOG_API_KEY> <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - - %msg%\n"
332-
333-
ruleset(name="infiles") {
334-
action(type="omfwd" protocol="tcp" target="intake.logs.<site_url>" port="10514" template="DatadogFormat")
335-
}
336-
```
337-
338-
{{< /site-region >}}
339-
340-
{{< site-region region="us3,us5,ap1,gov" >}}
341-
342-
3. In `/etc/rsyslog.d/datadog.conf`, add the following configuration. Replace `<site_url>` with **{{< region-param key="dd_site" >}}** and `<API_KEY>` with your Datadog API key. You must include a separate `input` line for each log file you want to monitor:
343-
344-
```conf
345-
## For each file to send
346-
input(type="imfile" ruleset="infiles" Tag="<TAGS>" File="<PATH_TO_FILE1>")
347-
348-
## Set the Datadog Format to send the logs
349-
template(name="test_template" type="list") { constant(value="{") property(name="msg" outname="message" format="jsonfr") constant(value="}")}
350-
351-
# include the omhttp module
352-
module(load="omhttp")
353-
354-
ruleset(name="infiles") {
355-
action(type="omhttp" server="http-intake.logs.<site_url>" serverport="443" restpath="api/v2/logs" template="test_template" httpheaders=["DD-API-KEY: <API_KEY>", "Content-Type: application/json"])
356-
}
357-
```
358-
{{< /site-region >}}
359-
360-
4. Restart Rsyslog. Your new logs are forwarded directly to your Datadog account.
361-
```shell
362-
sudo systemctl restart rsyslog
363-
```
364-
365-
5. Associate your logs with the host metrics and tags:
366-
367-
To make sure that your logs are associated with the metrics and tags from the same host in your Datadog account, set the `HOSTNAME` in your `rsyslog.conf` to match the hostname of your Datadog metrics.
368-
- If you specified a hostname in `datadog.conf` or `datadog.yaml`, replace the `%HOSTNAME%` value in `rsyslog.conf` to match your hostname.
369-
- If you did not specify a hostname in `datadog.conf` or `datadog.yaml`, you do not need to change anything.
370-
371-
6. To get the best use out of your logs in Datadog, set a source for the logs.
372-
- If you [forward your logs to the Datadog Agent][1], you can set the source in the Agent configuration file.
373-
- If you're not forwarding your logs to the Datadog Agent, create a distinct configuration file for each source in `/etc/rsyslog.d/`:
374-
375-
To set the source, use the following format (if you have several sources, change the name of the format in each file):
376-
377-
```conf
378-
$template DatadogFormat,"<DATADOG_API_KEY> <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - [metas ddsource=\"<MY_SOURCE_NAME>\"] %msg%\n"
379-
```
380-
381-
You can add custom tags with the `ddtags` attribute:
382-
383-
```conf
384-
$template DatadogFormat,"<DATADOG_API_KEY> <%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% - - [metas ddsource=\"<MY_SOURCE_NAME>\" ddtags=\"env:dev,<KEY:VALUE>\"] %msg%\n"
385-
```
386-
387-
7. (Optional) Datadog cuts inactive connections after a period of inactivity. Some versions of Rsyslog are not able to reconnect when necessary. To mitigate this issue, use time markers so the connection never stops:
388-
389-
1. Add the following two lines to your Rsyslog configuration file:
390-
391-
```conf
392-
$ModLoad immark
393-
$MarkMessagePeriod 20
394-
```
395-
396-
2. Restart the Rsyslog service:
397-
398-
```shell
399-
sudo systemctl restart rsyslog
400-
```
401-
402-
{{% site-region region="us" %}}
403-
8. (Optional) Add TLS Encryption to logs sent from Rsyslog to your Datadog account.
404-
1. Install the `rsyslog-gnutls` and `ca-certificates` packages:
405-
```shell
406-
sudo dnf install rsyslog-gnutls ca-certificates
407-
```
408-
2. Add the following line to the bottom of your `/etc/rsyslog.d/datadog.conf` file:
409-
```conf
410-
## Define the destination for the logs
411-
$DefaultNetstreamDriverCAFile /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
412-
ruleset(name="infiles") {
413-
action(type="omfwd" protocol="tcp" target="intake.logs.datadoghq.com" port="10516" template="DatadogFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.datadoghq.com" )
414-
}
415-
```
416-
3. Restart the Rsyslog service:
417-
418-
```shell
419-
sudo systemctl restart rsyslog
420-
```
421-
{{% /site-region %}}
422-
423-
{{% site-region region="eu" %}}
424-
425-
8. (Optional) Add TLS Encryption to logs sent from Rsyslog to your Datadog account.
426-
1. Install the `rsyslog-gnutls` and `ca-certificates` packages:
427-
```shell
428-
sudo dnf install rsyslog-gnutls ca-certificates
429-
```
430-
431-
2. Add the following line to the bottom of your `/etc/rsyslog.d/datadog.conf` file:
432-
```conf
433-
## Define the destination for the logs
434-
$DefaultNetstreamDriverCAFile /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
435-
ruleset(name="infiles") {
436-
action(type="omfwd" protocol="tcp" target="tcp-intake.logs.datadoghq.eu" port="443" template="DatadogFormat" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logs.datadoghq.eu" )
437-
}
438-
```
439-
3. Restart the Rsyslog service:
440-
441-
```shell
442-
sudo systemctl restart rsyslog
443-
```
444-
{{% /site-region %}}
445-
446-
[1]: /agent/logs/
447-
{{% /tab %}}
448-
449-
{{< /tabs >}}
450-
451111
## Troubleshooting
452112
453113
Need help? Contact [Datadog support][1].

0 commit comments

Comments
 (0)