1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
[syslog tail]
## Example: Log collector that will tail the syslog file and count
## occurences of certain keywords, using POSIX regular expressions.
## Required settings
enabled = no
log type = flb_tail
## Optional settings, common to all log source.
## Uncomment to override global equivalents in netdata.conf.
# update every = 1
# update timeout = 10
# use log timestamp = auto
# circular buffer max size MiB = 64
# circular buffer drop logs if full = no
# compression acceleration = 1
# db mode = none
# circular buffer flush to db = 6
# disk space limit MiB = 500
## This section supports auto-detection of log file path if section name
## is left unchanged, otherwise it can be set manually, e.g.:
## log path = /var/log/syslog
## log path = /var/log/messages
## See README for more information on 'log path = auto' option
log path = auto
## Use inotify instead of file stat watcher. Set to 'no' to reduce CPU usage.
use inotify = yes
## Submit structured log entries to the system journal
# submit logs to system journal = no
## Charts to enable
# collected logs total chart enable = no
# collected logs rate chart enable = yes
## Examples of extracting custom metrics from syslog:
# custom 1 chart = identifier
# custom 1 regex name = kernel
# custom 1 regex = .*\bkernel\b.*
# custom 1 ignore case = no
# custom 2 chart = identifier
# custom 2 regex name = systemd
# custom 2 regex = .*\bsystemd\b.*
# custom 2 ignore case = no
# custom 3 chart = identifier
# custom 3 regex name = CRON
# custom 3 regex = .*\bCRON\b.*
# custom 3 ignore case = no
# custom 3 chart = identifier
# custom 3 regex name = netdata
# custom 3 regex = .*\netdata\b.*
# custom 3 ignore case = no
[syslog Unix socket]
## Example: Log collector that will listen for RFC-3164 syslog on a UNIX
## socket that will be created on /tmp/netdata-syslog.sock .
## Required settings
enabled = no
log type = flb_syslog
## Optional settings, common to all log source.
## Uncomment to override global equivalents in netdata.conf.
# update every = 1
# update timeout = 10
# use log timestamp = auto
# circular buffer max size MiB = 64
# circular buffer drop logs if full = no
# compression acceleration = 1
# db mode = none
# circular buffer flush to db = 6
# disk space limit MiB = 500
## Netdata will create this socket if mode == unix_tcp or mode == unix_udp,
## please ensure the right permissions exist for this path
log path = /tmp/netdata-syslog.sock
## Ruby Regular Expression to define expected syslog format
## Please make sure <PRIVAL>, <SYSLOG_TIMESTAMP>, <HOSTNAME>, <SYSLOG_IDENTIFIER>, <PID> and <MESSAGE> are defined
## see also https://docs.fluentbit.io/manual/pipeline/parsers/regular-expression
log format = /^\<(?<PRIVAL>[0-9]+)\>(?<SYSLOG_TIMESTAMP>[^ ]* {1,2}[^ ]* [^ ]* )(?<HOSTNAME>[^ ]*) (?<SYSLOG_IDENTIFIER>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<PID>[0-9]+)\])?(?:[^\:]*\:)? *(?<MESSAGE>.*)$/
## Set up configuration specific to flb_syslog
## see also https://docs.fluentbit.io/manual/pipeline/inputs/syslog#configuration-parameters
## Modes supported are: unix_tcp, unix_udp, tcp, udp
mode = unix_udp
# listen = 0.0.0.0
# port = 5140
unix_perm = 0666
## Charts to enable
# collected logs total chart enable = no
# collected logs rate chart enable = yes
priority value chart = yes
severity chart = yes
facility chart = yes
[syslog TCP socket]
## Example: Log collector that will listen for RFC-3164 syslog,
## incoming via TCP on localhost IP and port 5140.
## Required settings
enabled = no
log type = flb_syslog
## Optional settings, common to all log source.
## Uncomment to override global equivalents in netdata.conf.
# update every = 1
# update timeout = 10
# use log timestamp = auto
# circular buffer max size MiB = 64
# circular buffer drop logs if full = no
# compression acceleration = 1
# db mode = none
# circular buffer flush to db = 6
# disk space limit MiB = 500
## Netdata will create this socket if mode == unix_tcp or mode == unix_udp,
## please ensure the right permissions exist for this path
# log path = /tmp/netdata-syslog.sock
## Ruby Regular Expression to define expected syslog format
## Please make sure <PRIVAL>, <SYSLOG_TIMESTAMP>, <HOSTNAME>, <SYSLOG_IDENTIFIER>, <PID> and <MESSAGE> are defined
## see also https://docs.fluentbit.io/manual/pipeline/parsers/regular-expression
log format = /^\<(?<PRIVAL>[0-9]+)\>(?<SYSLOG_TIMESTAMP>[^ ]* {1,2}[^ ]* [^ ]* )(?<HOSTNAME>[^ ]*) (?<SYSLOG_IDENTIFIER>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<PID>[0-9]+)\])?(?:[^\:]*\:)? *(?<MESSAGE>.*)$/
## Set up configuration specific to flb_syslog
## see also https://docs.fluentbit.io/manual/pipeline/inputs/syslog#configuration-parameters
## Modes supported are: unix_tcp, unix_udp, tcp, udp
mode = tcp
listen = 0.0.0.0
port = 5140
# unix_perm = 0666
## Charts to enable
# collected logs total chart enable = no
# collected logs rate chart enable = yes
priority value chart = yes
severity chart = yes
facility chart = yes
|
