How to install rsyslog
rsyslog is used to gather logs from distributed server nodes on one central server node where they were stored in log files. In our installation, all nodes are sending their log to the storage node.
The (r)syslog daemon is installed by default on ubuntu min. > 12.04 and centos min. > 6.5.
Configure the sources
Create the file /etc/rsyslog.d/10-remotelog.conf
# send logs to the storage node
# same as written to /var/log/messages
*.info;mail.none;authpriv.none;cron.none @@10.1.1.12:5327
# openstack logs
local0.* @@10.1.1.12:5327
Tell each OpenStack component to use syslog for logging. Place the following in [DEFAULT] of e.g. /etc/nova/nova.conf
...
verbose = False
debug = False
use_syslog = True
syslog_log_facility = LOG_LOCAL0
...
Configure the sink
Edit the file /etc/rsyslog.conf
...
# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 5327
...
Create the file /etc/rsyslog.d/10-remotelog.conf
# send logs to the storage node
$template PerHostLog,"/var/log/cluster/%HOSTNAME%.log"
if $fromhost-ip startswith '10.1.1.' then -?PerHostLog
& ~