https://github.com/logdna/logdna-rsyslog
Kubernetes rsyslog proxy for forwarding logs to LogDNA
https://github.com/logdna/logdna-rsyslog
Last synced: 6 months ago
JSON representation
Kubernetes rsyslog proxy for forwarding logs to LogDNA
- Host: GitHub
- URL: https://github.com/logdna/logdna-rsyslog
- Owner: logdna
- Created: 2019-08-06T00:42:36.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2022-11-01T16:48:24.000Z (over 3 years ago)
- Last Synced: 2025-05-27T19:08:16.617Z (about 1 year ago)
- Language: Dockerfile
- Size: 20.5 KB
- Stars: 0
- Watchers: 22
- Forks: 2
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
## logdna-rsyslog
### Overview
logdna-rsyslog receives syslog logs via rsyslog and forwards them to LogDNA's https endpoint. It is currently only intended for use on a Kubernetes cluster, and not other container-based frameworks, such as Docker, but can be adapted fairly easily. This project is currently in beta.
### Installation steps
You can install logdna-rsyslog https forwarder with 3 kubectl commands:
```
kubectl create secret generic logdna-agent-key --from-literal=logdna-agent-key=REPLACE-WITH-LOGDNA-INGESTION-KEY
kubectl apply -f https://raw.githubusercontent.com/logdna/logdna-rsyslog/master/logdna-rsyslog-config-https.yml
kubectl apply -f https://raw.githubusercontent.com/logdna/logdna-rsyslog/master/logdna-rsyslog-workload.yml
```
### Usage and modification
After applying the above commands, you should begin to see logs in the LogDNA web UI. You can also modify the following in `logdna-rsyslog-config-https.yml` to adjust logdna-rsyslog to your liking
* The`logdna-url` is set to `logs.logdna.com`, but can be changed to send to other LogDNA deployment sites.
* The `logdna-rsyslog` rsyslog template can be customized to pre-parse problematic / non-compliant rsyslog lines (e.g. router or motherboard firmware logs)
* The `logdna-rsyslog` service endpoint can be configured to be an external LoadBalancer or NodePort if you wish to expose the service publicly
For reference, the Docker image is available on [Docker Hub](https://hub.docker.com/r/logdna/logdna-rsyslog)
### TCP+TLS support
As an alternate mechanism, you can also stream logs to us via the traditional TCP+TLS rsyslog method. This is not recommended, as https is more robust, but this can act as a useful fallback or test harness. Install the TCP+TLS version is very similar to the https steps:
```
kubectl create secret generic logdna-agent-key --from-literal=logdna-agent-key=REPLACE-WITH-LOGDNA-INGESTION-KEY
kubectl apply -f https://raw.githubusercontent.com/logdna/logdna-rsyslog/master/logdna-rsyslog-config-tls.yml
kubectl apply -f https://raw.githubusercontent.com/logdna/logdna-rsyslog/master/logdna-rsyslog-workload.yml
```
### Future improvements
While this application is functional and has been tested in Kubernetes, there are a number of future improvements we have in mind:
* Allow receiving rsyslog lines over TCP+TLS instead of plain TCP
* Configure batching of lines for better ingestion performance
* Add Kubernetes RBAC and don't run the image as the root user (better security)