How to install rsyslog

rsyslog is used to gather logs from distributed server nodes on one central server node where they were stored in log files. In our installation, all nodes are sending their log to the storage node.

The (r)syslog daemon is installed by default on ubuntu min. > 12.04 and centos min. > 6.5.

Configure the sources

Create the file /etc/rsyslog.d/10-remotelog.conf

# send logs to the storage node

# same as written to /var/log/messages
*.info;mail.none;authpriv.none;cron.none           @@10.1.1.12:5327

# openstack logs
local0.*                                           @@10.1.1.12:5327

Tell each OpenStack component to use syslog for logging. Place the following in [DEFAULT] of e.g. /etc/nova/nova.conf

...
verbose = False
debug = False
use_syslog = True
syslog_log_facility = LOG_LOCAL0
...

Configure the sink

Edit the file /etc/rsyslog.conf

...
# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 5327
...

Create the file /etc/rsyslog.d/10-remotelog.conf

# send logs to the storage node
$template PerHostLog,"/var/log/cluster/%HOSTNAME%.log"
if $fromhost-ip startswith '10.1.1.' then -?PerHostLog
& ~