syslog is a protocol to send events and messages from a client machine to a server. The Syslog protocol is supported by a wide range of devices and can be used to log different types of events. "rsyslog" is one of the most widely deployed implementations of the syslog protocol.
In some cases, users may need to configure a Contrail compute node to send log messages (for example, flow information) to a remote server via rsyslog.
In this article, we demonstrate the end-to-end Contrail compute node configurations in our lab, including configurations for the vrouter agent, rsyslog, and the client and rsyslog servers.
vrouter Configuration
An example vrouter configuration with syslog enabled is given as follows. The inline comments give a brief description of each option. Refer to the following Contrail documentation for more information about each option:
Sending Flow Messages to the Contrail System Log
contrail-vrouter-agent.conf
[DEFAULT] #Local log file name log_file=/var/log/contrail/contrail-vrouter-agent.log #Log severity levels. Possible values are SYS_EMERG, SYS_ALERT, SYS_CRIT, SYS_ERR, SYS_WARN, SYS_NOTICE, SYS_INFO and SYS_DEBUG. Default is SYS_NOTICE. log_level=SYS_INFO #Enable/Disable local flow message logging. Possible values are 0 (disable) and 1 (enable). Flag is deprecated as of 5.0.1. log_flow=1 syslog_facility=LOG_LOCAL0 #Enable/disable headless mode for an agent. In headless mode, the agent retains the last known good configuration from the control node when all control nodes are lost. Possible values are true (enable) and false (disable). headless_mode=false #Sandesh send rate limit can be used to throttle system logs transmitted per second. System logs are dropped if the sending rate is exceeded.
sandesh_send_rate_limit=10 #Enables sending of all messages, including flow messages, to syslog use_syslog=1 Enable/Disable local file logging. Possible values are 0 (disable) and 1 #(enable) log_local=1 log_file_size=1073741824 log_files_count=0 platform=dpdk physical_interface_address=0000:00:00.0 physical_interface_mac=5c:b9:01:8b:6f:3c physical_uio_driver=igb_uio [HYPERVISOR] type=kvm vmware_mode= vmware_physical_interface= [DISCOVERY] server=10.168.10.22 max_control_nodes=3 [FLOWS] # Number of threads for flow setup thread_count=4 [TASK] # Number of threads used by TBB (Intel® Threading Building Blocks, widely used C++ library for shared memory parallel programming) thread_count=8 [NETWORKS] control_network_ip=172.18.78.2 [VIRTUAL-HOST-INTERFACE] name=vhost0 ip=172.18.78.2/24 gateway=172.18.78.1 physical_interface=bond0.2004 [SERVICE-INSTANCE] netns_command=/usr/bin/opencontrail-vrouter-netns
Note: The " use_syslog=1 " option enables the syslog feature. After making any changes in this file, restart the vrouter agent to make the changes take effect.
use_syslog=1
service supervisor-vrouter start
rsyslog Client Configuration
Most rsyslog deployments are running on top of UDP with port 514. However, in some cases, customers may need to run rsyslog over TCP for more reliable log transfer.
For a TCP rsyslog client, keep all other files coming with the rsyslog installation intact. In /etc/rsyslog.d/ , create a file with the following line:
/etc/rsyslog.d/
*.* @@10.85.188.59:514
This will trigger the client to try and establish a TCP connection to the specified server, and upon connection, an rsyslog message will be sent to the remote server via TCP.
For a UDP client, in the same /etc/rsyslog.d/ file, create a file with the following notation:
*.* @10.85.188.59:514
As you can see:
"@@" means TCP.
"@" means UDP.
After making any change, restart the rsyslog process on the client to make the changes take effect.
service rsyslog restart
rsyslog Server Configuration
To set up a TCP server, in the /etc/rsyslog.conf file, make sure to have the following two options:
/etc/rsyslog.conf
# provides TCP syslog reception $ModLoad imtcp $InputTCPServerRun 514
To enable a UDP-based syslog server, comment the above options and uncomment the following two options:
## provides UDP syslog reception #$ModLoad imudp #$UDPServerRun 514
Again, after making any changes, restart the rsyslog process on the server to make the changes take effect.
Verifying the vrouter Syslog Configuration
From vrouter (as the rsyslog client) or the rsyslog server:
$ netstat -lanpo | grep :514 tcp 0 0 10.85.180.78:37120 10.85.180.68:514 ESTABLISHED 1277/rsyslogd off (0.00/0/0)
From the syslog server, to see the syslog messages received from the client:
root@kvm789:/var/log# tail syslog Sep 9 14:49:25 bcomp80 dpdk[3910]: Write: Encode sandesh vr_interface_req FAILED(0) Sep 9 14:49:25 bcomp80 contrail-vrouter-agent[17716]: 2019-09-09 Mon 14:49:25:004.002 PDT bcomp80 [Thread 139632032503552, Pid 17716]: SANDESH: Sending: LEVEL: [ SYS_DEBUG ] -> [ INVALID ] : 1940 Sep 9 14:49:25 bcomp80 dpdk[3910]: Write: Encode sandesh vr_interface_req FAILED(0) Sep 9 14:49:25 bcomp80 dpdk[3910]: message repeated 12 times: [ Write: Encode sandesh vr_interface_req FAILED(0)] Sep 9 14:49:25 bcomp80 contrail-vrouter-agent[17716]: 2019-09-09 Mon 14:49:25:016.417 PDT bcomp80 [Thread 139632072554240, Pid 17716]: SANDESH: Sending: LEVEL: [ INVALID ] -> [ SYS_DEBUG ] : 2610 Sep 9 14:49:25 bcomp80 contrail-vrouter-agent[17716]: 2019-09-09 Mon 14:49:25:017.579 PDT bcomp80 [Thread 139632072554240, Pid 17716]: SANDESH: Sending: LEVEL: [ SYS_DEBUG ] -> [ INVALID ] : 1704 Sep 9 14:49:25 bcomp80 contrail-vrouter-agent[17716]: 2019-09-09 Mon 14:49:25:020.181 PDT bcomp80 [Thread 139632072554240, Pid 17716]: SANDESH: Sending: LEVEL: [ INVALID ] -> [ SYS_DEBUG ] : 10744 Sep 9 14:49:25 bcomp80 contrail-vrouter-agent[17716]: 2019-09-09 Mon 14:49:25:027.053 PDT bcomp80 [Thread 139632072554240, Pid 17716]: SANDESH: Sending: LEVEL: [ SYS_DEBUG ] -> [ INVALID ] : 1640 Sep 9 14:49:25 bcomp80 contrail-vrouter-agent[17716]: 2019-09-09 Mon 14:49:25:028.112 PDT bcomp80 [Thread 139632072554240, Pid 17716]: SANDESH: Sending: LEVEL: [ INVALID ] -> [ SYS_DEBUG ] : 10678 Sep 9 14:49:25 bcomp80 contrail-vrouter-agent[17716]: 2019-09-09 Mon 14:49:25:034.302 PDT bcomp80 [Thread 139632072554240, Pid 17716]: SANDESH: Sending: LEVEL: [ SYS_DEBUG ] -> [ INVALID ] : 1265 root@kvm789:/var/log#