The stackdriver() destination of syslog-ng PE can send log messages to the Google Stackdriver cloud. Google Stackdriver is a widely used metrics, event, and log aggregator and analyzer system. The stackdriver destination is available in syslog-ng PE version 7.0.14 and later.
How the stackdriver() destination works
The stackdriver() destination uses the HTTP REST API to perform OAuth2 authentication to Google Stackdriver and obtains an access token from Stackdriver using the key specified in a JSON file. This access token is required to send logs to Stackdriver using the Stackdriver Logging API.
The syslog-ng PE application automatically refreshes the token when it expires (usually every 60 minutes). The syslog-ng PE application stores the token it obtains, even if you restart or reload syslog-ng PE. If you change the JSON key on your syslog-ng PE host, syslog-ng PE will start using the new key only when the stored access token expires or becomes invalid.
By default, syslog-ng PE uses the default system CA certificate store to validate the certificate sent by Google Stackdriver. If the Certificate Authority of the certificate sent by Google Stackdriver is not available on your host, you must download the CA certificate and add it to the certificate store. The location of the certificate store depends on your platform. Most commonly, it is one of the following (or a similar location):
-
/etc/ssl/certs/
-
/etc/pki/ca-trust/
-
/etc/pki/tls/certs/
Limitations
-
The log_id() option of the destination currently does not support macros or templates, only strings. As a result, every log entry has the same log id.
-
Currently the following resource types are supported: generic_node, generic_task, and global. You can configure other resource types, but they are untested.
-
Each syslog-ng PE stackdriver() destination can use only one resource type. If you want to send logs using multiple resource types, you must configure multiple stackdriver() destinations.
-
When referring to options in the syslog-ng PE configuration file, the hyphen (-) and underscore (_) characters are usually interchangeable. In the stackdriver destination, you must use underscore (_) in the options that syslog-ng PE passes directly to Google Stackdriver. These options are the following:
NOTE: Typically, only the central syslog-ng PE server uses this destination. For more information on the server mode, see Server mode.
Declaration
destination d_stackdriver {
stackdriver(
gcp_auth_header(
credentials("<path-to-the-service.json>")
)
log_id("<folder-name-for-logs-in-stackdriver>")
resource(
project_id("<identifier-of-the-GCP-project>")
<parameters-of-the-monitored-resource>
)
);
};
Example: Sending log messages to Google Stackdriver
Using a generic_node() resource type to send log messages to Google Stackdriver
destination d_stackdriver {
stackdriver(
gcp_auth_header(
credentials("/opt/syslog-ng/etc/service.json")
)
log_id("123456")
resource(
generic_node(
project_id("my-test-project")
location("EU/Budapest")
namespace("my cluster")
node_id("$HOST")
)
)
[...]
);
};
Batch size
The batch-lines(), batch-lines(), and batch-timeout() options of the destination determine how many log messages syslog-ng PE sends in a batch. The batch-lines() option determines the maximum number of messages syslog-ng PE puts in a batch in. This can be limited based on size and time:
-
syslog-ng PE sends a batch every batch-timeout() milliseconds, even if the number of messages in the batch is less than batch-lines(). This ensures that the destination receives every message in a timely manner even if suddenly there are no more messages.
-
syslog-ng PE sends the batch if the total size of the messages in the batch reaches batch-bytes() bytes.
To increase the performance of the destination, increase the number of worker threads for the destination using the workers() option, or adjust the batch-bytes(), batch-lines(), batch-timeout() options.
This procedure summarizes how to send log messages from syslog-ng Premium Edition (syslog-ng PE) to Google Stackdriver.
The stackdriver destination of syslog-ng PE can send log messages to the Google Stackdriver cloud. The stackdriver destination has the following options. Available in syslog-ng PE version 7.0.14 and later.
|
|
Caution:
When referring to options in the syslog-ng PE configuration file, the hyphen (-) and underscore (_) characters are usually interchangeable. In the stackdriver destination, you must use underscore (_) in the options that syslog-ng PE passes directly to Google Stackdriver. These options are the following:
|
batch-bytes()
| Accepted values: |
number [bytes] |
| Default: |
none |
Description: Sets the maximum size of payload in a batch. If the size of the messages reaches this value, syslog-ng PE sends the batch to the destination even if the number of messages is less than the value of the batch-lines() option.
Note that if the batch-timeout() option is enabled and the queue becomes empty, syslog-ng PE flushes the messages only if batch-timeout() expires, or the batch reaches the limit set in batch-bytes().
Available in syslog-ng PE version 7.0.12 and later.
For more information on how this option influences batch mode, see Batch size.
batch-lines()
| Type: |
number [lines] |
| Default: |
1 |
Description: Specifies how many lines are flushed to a destination in one batch. The syslog-ng PE application waits for this number of lines to accumulate and sends them off in a single batch. Increasing this number increases throughput as more messages are sent in a single batch, but also increases message latency.
For example, if you set batch-lines() to 100, syslog-ng PE waits for 100 messages.
If the batch-timeout() option is disabled, the syslog-ng PE application flushes the messages if it has sent batch-lines() number of messages, or the queue became empty. If you stop or reload syslog-ng PE or in case of network sources, the connection with the client is closed, syslog-ng PE automatically sends the unsent messages to the destination.
If the batch-timeout() option is enabled and the queue becomes empty, syslog-ng PE flushes the messages only if batch-timeout() expires, or the batch reaches the limit set in batch-lines().
For optimal performance, make sure that the syslog-ng PE source that feeds messages to this destination is configured properly: the value of the log-iw-size() option of the source must be higher than the batch-lines()*workers() of the destination. Otherwise, the size of the batches cannot reach the batch-lines() limit.
For more information on how this option influences batch mode, see Batch size.
batch-timeout()
| Type: |
time [milliseconds] |
| Default: |
-1 (disabled) |
Description: Specifies the time syslog-ng PE waits for lines to accumulate in the output buffer. The syslog-ng PE application sends batches to the destinations evenly. The timer starts when the first message arrives to the buffer, so if only few messages arrive, syslog-ng PE sends messages to the destination once every batch-timeout() milliseconds at most.
For more information on how this option influences batch mode, see Batch size.
disk-buffer()
Description: This option enables putting outgoing messages into the disk-buffer file of the destination to avoid message loss in case of a system failure on the destination side. It has the following options:
| dir() |
| Type: |
string |
| Default: |
N/A |
|
Description: Defines the folder where the disk-buffer files are stored.
Note that changing the value the dir() option will not move or copy existing files from the old directory to the new one.
|
|
Caution:
When creating a new dir() option for a disk-buffer file, or modifying an existing one, make sure you delete the persist file.
syslog-ng PE creates disk-buffer files based on the path recorded in the persist file. Therefore, if the persist file is not deleted after modifying the dir() option, then following a restart, syslog-ng PE will look for or create disk-buffer files in their old location. To ensure that syslog-ng PE uses the new dir() setting, the persist file must not contain any information about the destinations which the disk-buffer file in question belongs to. | |
| disk-buf-size() |
| Type: |
number [bytes] |
| Default: |
|
| Description: This is a required option. The maximum size of the disk-buffer file in bytes. The minimum value is 1048576 bytes. If you set a smaller value, the minimum value will be used automatically. It replaces the old log-disk-fifo-size() option. |
| mem-buf-length() |
| Type: |
number [messages] |
| Default: |
10000 |
| Description: Use this option if the option reliable() is set to no. This option contains the number of messages stored in overflow queue. It replaces the old log-fifo-size() option. It inherits the value of the global log-fifo-size() option if provided. If it is not provided, the default value is 10000 messages. Note that this option will be ignored if the option reliable() is set to yes. |
| mem-buf-size() |
| Type: |
number [bytes] |
| Default: |
163840000 |
| Description: Use this option if the option reliable() is set to yes. This option contains the size of the messages in bytes that is used in the memory part of the disk-buffer file. It replaces the old log-fifo-size() option. It does not inherit the value of the global log-fifo-size() option, even if it is provided. Note that this option will be ignored if the option reliable() is set to no. |
| quot-size() |
| Type: |
number [messages] |
| Default: |
1000 |
|
Description: The number of messages stored in the output buffer of the destination. Note that if you change the value of this option and the disk-buffer file already exists, the change will take effect when the disk-buffer file becomes empty. |
| reliable() |
| Type: |
yes|no |
| Default: |
no |
|
Description: If set to yes, syslog-ng PE cannot lose logs in case of reload/restart, unreachable destination or syslog-ng PE crash. This solution provides a slower, but reliable disk-buffer option. It is created and initialized at startup and gradually grows as new messages arrive. If set to no, the normal disk-buffer option will be used. This provides a faster, but less reliable disk-buffer option.
|
|
Caution: Hazard of data loss!
If you change the value of reliable() option when there are messages in the disk-buffer file, the messages stored in the disk-buffer file will be lost. | |
| truncate-size-ratio() |
| Type: |
number (for percentage) between 0 and 1 |
| Default: |
0.1 (10%) |
|
Description: Limits the truncation of the disk-buffer file. Truncating the disk-buffer file can slow down disk I/O operations, but it saves disk space. As a result, syslog-ng PE only truncates the file if the possible disk gain is more than truncate-size-ratio() times disk-buf-size().
|
|
Caution:
One Identity recommends that you do not modify the value of the truncate-size-ratio() option unless you are fully aware of the potential performance implications. | |
Example: Examples for using disk-buffer()
In the following case, reliable disk-buffer() is used.
destination d_demo {
network("127.0.0.1"
port(3333)
disk-buffer(
mem-buf-size(10000)
disk-buf-size(2000000)
reliable(yes)
dir("/tmp/disk-buffer")
)
);
};
In the following case normal disk-buffer() is used.
destination d_demo {
network("127.0.0.1"
port(3333)
disk-buffer(
mem-buf-length(10000)
disk-buf-size(2000000)
reliable(no)
dir("/tmp/disk-buffer")
)
);
};
gcp_auth_header()
Description: This option stores the service key and other parameters needed for the stackdriver destination to successfully connect to Google Stackdriver. It has the following options. The credentials() option is a required options.
| credentials() |
| Type: |
path |
| Default: |
N/A |
|
Description: The path to the JSON file that contains the key for the service account. The service account must have at least the logging.write role. For details, see Configuring syslog-ng PE to send logs to Google Stackdriver
The syslog-ng PE application automatically refreshes the token when it expires (usually every 60 minutes). The syslog-ng PE application stores the token it obtains, even if you restart or reload syslog-ng PE. If you change the JSON key on your syslog-ng PE host, syslog-ng PE will start using the new key only when the stored access token expires or becomes invalid. |
hook-commands()
Description: This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The hook-commands() can be used with all source and destination drivers with the exception of the usertty() and internal() drivers.
NOTE: The syslog-ng PE application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable syslog-ng PE to execute external applications.
Using the hook-commands() when syslog-ng PE starts or stops
To execute an external program when syslog-ng PE starts or stops, use the following options:
| startup() |
| Type: |
string |
| Default: |
N/A |
|
Description: Defines the external program that is executed when syslog-ng PE starts. |
| shutdown() |
| Type: |
string |
| Default: |
N/A |
|
Description: Defines the external program that is executed when syslog-ng PE stops. |
Using the hook-commands() when syslog-ng PE reloads
To execute an external program when the syslog-ng PE configuration is initiated or torn down (for example, on startup/shutdown or during a syslog-ng PE reload), use the following options:
| setup() |
| Type: |
string |
| Default: |
N/A |
|
Description: Defines an external program that is executed when the syslog-ng PE configuration is initiated, for example, on startup or during a syslog-ng PE reload. |
| teardown() |
| Type: |
string |
| Default: |
N/A |
|
Description: Defines an external program that is executed when the syslog-ng PE configuration is stopped or torn down, for example, on shutdown or during a syslog-ng PE reload. |
Example: Using the hook-commands() with a network source
In the following example, the hook-commands() is used with the network() driver and it opens an iptables port automatically when syslog-ng PE is started/stopped.
The assumption in this example is that the LOGCHAIN chain is part of a larger ruleset that routes traffic to it. Whenever the syslog-ng PE created rule is there, packets can flow (otherwise the port is closed).
source {
network(transport(udp)
hook-commands(
startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
shutdown("iptables -D LOGCHAIN 1")
;)
);
};
json-payload()
| Accepted values: |
template function |
| Default: |
$(format-json --scope rfc5424 --exclude DATE --key ISODATE) |
Description: The payload of the log message that syslog-ng PE sends to Google Stackdriver. The payload must be a JSON-formatted list of name-value pairs. For details on selecting name-value pairs, see value-pairs(). By default, syslog-ng PE uses the rfc5424 scope, which is the same as the one that the syslog() destination uses.
log-fifo-size()
| Type: |
number |
| Default: |
Use global setting. |
Description: The number of messages that the output queue can store.
log_id()
| Accepted values: |
string |
| Default: |
none |
Description: The name of the folder that stores the logs in Google Stackdriver. The value of the log_id() option must be less than 512 characters long and can only include the following characters: upper and lower case alphanumeric characters, forward-slash, underscore, hyphen, and period.
NOTE: The log-id() option is mandatory. If not referred to, the Stackdriver server will send the following HTTP response to syslog-ng PE:
"error": {
"code": 400,
"message":"Log name contains illegal character",
"status":"INVALID_ARGUMENT"
persist-name()
| Type: |
string |
| Default: |
None |
Description:If you receive the following error message during syslog-ng PE startup, set the persist-name() option of the duplicate drivers:
Error checking the uniqueness of the persist names, please override it with persist-name option. Shutting down.
This error occurs if you use identical drivers in multiple sources, for example, if you configure two file sources to read from the same file. In this case, set the persist-name() of the drivers to a custom string, for example, persist-name("example-persist-name1").
proxy()
| Type: |
The proxy server address, in proxy("PROXY_IP:PORT") format.
For example, proxy("http://myproxy:3128") |
| Default: |
None |
Description:
The proxy() option enables you to configure the stackdriver driver to use a specific HTTP proxy for all HTTP-based destinations, instead of using the proxy that is configured for the system.
If you do not set the proxy() option, the stackdriver driver uses the http_proxy and https_proxy environment variables, as shown in CURLOPT_PROXY explained.
NOTE: Configuring the proxy() option overwrites the default http_proxy and https_proxy environment variables.
resource()
| Type: |
string |
| Default: |
None |
Description: Specifies the type of the monitored resource and its fields, as described in the Google Stackdriver documentation. You can use strings, macros, and templates in the values of the fields.
Currently the following resource types are supported: generic_node, generic_task, and global. You can configure other resource types, but they are untested.
One Identity recommends using the generic_node resource type. Each syslog-ng PE stackdriver destination can use only one resource type. If you want to send logs using multiple resource types, you must configure multiple stackdriver destinations.
|
|
Caution:
Make sure that you set the resource type and its fields correctly. The value of the project_id() field must be the Project ID of your Google Stackdriver project. The syslog-ng PE application cannot check the validity of this option. |
For example:
resource(
generic_node(
project_id("my-test-project")
location("EU/Budapest")
namespace("my cluster")
node_id("$HOST")))
retries()
| Type: |
number [of attempts] |
| Default: |
3 |
Description: The number of times syslog-ng PE attempts to send a message to this destination. If syslog-ng PE could not send a message, it will try again until the number of attempts reaches retries(), then drops the message.
The syslog-ng PE application handles HTTP error responses the following way.
-
If the server returns the 401 response code because the token expired, syslog-ng PE automatically requests a new token and resends the message.
-
If the HTTP server returns 4xx codes, syslog-ng PE will drop the messages.
-
If the HTTP server returns 5xx codes syslog-ng PE will attempt to resend messages until the number of attempts reaches retries.
throttle()
Description: Sets the maximum number of messages sent to the destination per second. Use this output-rate-limiting functionality only when using the disk-buffer option as well to avoid the risk of losing messages. Specifying 0 or a lower value sets the output limit to unlimited.
timeout()
| Type: |
number [seconds] |
| Default: |
0 |
Description: The value (in seconds) to wait for an operation to complete, and attempt to reconnect the server if exceeded. By default, the timeout value is 0, meaning that there is no timeout. Available in version 7.0.4 and later.
use-system-cert-store()
| Type: |
yes | no |
| Default: |
no |
Description: Use the certificate store of the system for verifying HTTPS certificates. For details, see the curl documentation.
workers()
Description: Specifies the number of worker threads (at least 1) that syslog-ng PE uses to send messages to the server. Increasing the number of worker threads can drastically improve the performance of the destination.
|
|
Caution:
Hazard of data loss!
When you use more than one worker threads together with the disk-buffer option, syslog-ng PE creates a separate disk-buffer file for each worker thread. This means that decreasing the number of workers can result in losing data currently stored in the disk-buffer files. Do not decrease the number of workers when the disk-buffer files are in use. |
If you are using load-balancing (that is, you have configured multiple servers in the url() option), increase the number of worker threads at least to the number of servers. For example, if you have set three URLs (url("site1" "site2" "site3")), set the workers() option to 3 or more.
The syslog() driver sends messages to a remote host (for example, a syslog-ng server or relay) on the local intranet or internet using the new standard syslog protocol developed by IETF (for details about the new protocol, see IETF-syslog messages). The protocol supports sending messages using the UDP, TCP, or the encrypted TLS networking protocols.
The required arguments of the driver are the address of the destination host (where messages should be sent). The transport method (networking protocol) is optional, syslog-ng uses the TCP protocol by default. For the list of available optional parameters, see syslog() destination options.
Declaration
syslog(host transport [options]);
NOTE: Note that the syslog destination driver has required parameters, while the source driver defaults to the local bind address, and every parameter is optional.
The udp transport method automatically sends multicast packets if a multicast destination address is specified. The tcp and tls methods do not support multicasting.
NOTE: The default ports for the different transport protocols are as follows: UDP — 514, TCP — 514, TLS — 6514.
Example: Using the syslog() driver
destination d_tcp {
syslog("10.1.2.3"
transport("tcp")
port(1999)
localport(999)
);
};
If name resolution is configured, the hostname of the target server can be used as well.
destination d_tcp {
syslog("target_host"
transport("tcp")
port(1999)
localport(999)
);
};
Send the log messages using TLS encryption and use mutual authentication. For details on the encryption and authentication options, see TLS options.
destination d_syslog_tls {
syslog("10.100.20.40"
transport("tls")
port(6514)
tls(
peer-verify(required-trusted)
ca-dir('/opt/syslog-ng/etc/syslog-ng/keys/ca.d/')
key-file('/opt/syslog-ng/etc/syslog-ng/keys/client_key.pem')
cert-file('/opt/syslog-ng/etc/syslog-ng/keys/client_certificate.pem')
)
);
};
