For the best user experience, we recommend logging into the LogDNA web app and following the account-tailored add a log source instructions. You may also follow the more generic instructions below
TCP+TLS (recommended)
To configure rsyslog to send logs to LogDNA via TCP secured with TLS, follow the steps below.
Download the LogDNA Root CA Certificate to
/etc/ld-root-ca.crt
Add the contents below to
/etc/rsyslog.d/22-logdna.conf
on your host machine. Be sure to insert your LogDNA Ingestion Key.
### START LogDNA rsyslog logging directives ###
## TCP TLS only ##
global(
DefaultNetstreamDriver="gtls"
DefaultNetstreamDriverCAFile="/etc/ld-root-ca.crt"
)
template(
name="LogDNAFormat"
type="string"
string="<%PRI%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [logdna@48950 key=\"YOUR-INGESTION-KEY-HERE\"] %msg%"
)
action(
type="omfwd"
template="LogDNAFormat"
target="syslog-a.logdna.com"
protocol="tcp"
port="6514"
StreamDriver="gtls"
StreamDriverMode="1" # run driver in TLS-only mode
StreamDriverAuthMode="x509/name"
StreamDriverPermittedPeers="*.logdna.com"
)
### END LogDNA rsyslog logging directives ###
Install
rsyslog-gnutls
using your package managerRestart syslog:
sudo /etc/init.d/rsyslog restart
TCP
To configure rsyslog to send logs to LogDNA via TCP, follow the steps below.
- Add the contents below to
/etc/rsyslog.d/22-logdna.conf
on your host machine. Be sure to insert your LogDNA Ingestion key.
### START LogDNA rsyslog logging directives ###
template(
name="LogDNAFormat"
type="string"
string="<%PRI%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [logdna@48950 key=\"YOUR-INGESTION-KEY-HERE\"] %msg%"
)
action(
type="omfwd"
template="LogDNAFormat"
target="syslog-a.logdna.com"
protocol="tcp"
port="514"
)
### END LogDNA rsyslog logging directives ###
- Restart syslog:
sudo /etc/init.d/rsyslog restart
UDP
Warning: UDP does not guarantee log line order. More information is available in this section of RFC 5426
To configure rsyslog to send logs to LogDNA via UDP, follow the steps below.
- Add the contents below to
/etc/rsyslog.d/22-logdna.conf
on your host machine. Be sure to insert your LogDNA Ingestion Key.
### START LogDNA rsyslog logging directives ###
template(
name="LogDNAFormat"
type="string"
string="<%PRI%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [logdna@48950 key=\"YOUR-INGESTION-KEY-HERE\"] %msg%"
)
action(
type="omfwd"
template="LogDNAFormat"
target="syslog-u.logdna.com"
protocol="udp"
port="514"
)
### END LogDNA rsyslog logging directives ###
- Restart syslog:
sudo /etc/init.d/rsyslog restart
Custom port
If you are unable to change the message template for rsyslog, you may provision a custom port by logging into the LogDNA web app and following the account-tailored add a log source instructions
Host tags
Host tags allow you to group hosts automatically without having to explicitly assign a host to a group within the LogDNA web app.
Host tags follow the syslog RFC-defined STRUCTURED-DATA format and requires configuring the template line in /etc/rsyslog.d/22-logdna.conf
to include the IANA-approved LogDNA Private Enterprise Number (PEN), 48950. For example:
template(
name="LogDNAFormat"
type="string"
string="<%PRI%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [logdna@48950 key=\"YOUR-INGESTION-KEY-HERE\" tags=\"prod,web\"] %msg%"
)
This would send up log lines from with the host tags prod
and web
, which would add this host to the prod and web tags.
Additional options
If possible, we highly recommend setting up a keepalive inside your rsyslog forwarding configuration. This ensures that bad connections are properly terminated and re-initiated and increases the reliability of log delivery. You can learn about rsyslog keepalive options here.
Updated 2 months ago