Uses rsyslogs facilities to forward to multiple remote syslog servers.
This Charm provides support for adding a rsyslog forwarder listener to any service.
In addition, this charm allows to have multiple rsyslog aggregators servers using two different replication
modes ( fanout, failover ).
By default the 'fanout' replication mode is going to be used, which means that all the
syslog messages will be forwarder to all aggregator servers.
Failover mode will forward all the syslog messages to the primary rsyslog server and
in case of failure will use the secondary rsyslog server.
In you want to choose to failover mode, this will require that your current
rsyslog server is binded to TCP port 514.
The charm can also optionally watch log files from apps which don't use syslog and forward those
log entries also. By default it will watch apt and dpkg log files.
This is a subordinate charm, which means it requires to have a service to hook in. On this
example we are going to deploy mysql
juju deploy mysql
Then you must deploy this charm
juju deploy rsyslog-forwarder-ha
Once your service is running, you can relate this charm:
juju add-relation rsyslog-forwarder-ha mysql
Then you can deploy your rsyslog aggregators servers:
juju deploy rsyslog primary juju deploy rsyslog secondary
Once your rsyslog aggregators are ready, you can relate them with your forwarder.
juju add-relation rsyslog-forwarder-ha primary juju add-relation rsyslog-forwarder-ha secondary
Once you have your rsyslog ports opened. You can change the replication-mode variable
on your rsyslog-forwarder-ha charm.
juju set rsyslog-forwarder-ha replication-mode="failover"
A comma-separated list of nagios servicegroups. If left empty, the nagios_context will be used as the servicegroup
transport protocol to use, currently supported options: udp, relp, tcp
Used by the nrpe-external-master subordinate charm. A string that will be prepended to instance name to set the host name in nagios. So for instance the hostname would be something like: juju-rsyslog-forwarder-ha-0 If you're running multiple environments with the same services in them this allows you to differentiate between them.
Possible options are 'fanout' or 'failover' fanout replicates the log messages over all the defined syslog relations, failover replicates the log messages just if the previous server is down. Failover always uses tcp for the protocol.
Should logs be written locally as well as forwarded?
A space separated list of files to follow with rsyslog imfile and forward to the aggregator. If set to empty string no files will be watched with imfile.
- /var/log/dpkg.log /var/log/apt/history.log