@@ -91,137 +91,43 @@ In order to get syslog messages you need to do the following (example for cisco
9191module(load="imudp")
9292#https://www.rsyslog.com/doc/master/configuration/modules/pmciscoios.html
9393module(load="pmciscoios")
94- # Pick your port to taste
95- input(type="imudp" port="30514" ruleset="withOrigin")
96- timezone(id="<yourtimezone>" offset="00:00")
94+
95+ input(type="imudp" port="10516" ruleset="withOrigin")
96+ input(type="imudp" port="10517" ruleset="withoutOrigin")
97+
98+ timezone(id="GMT" offset="+00:00")
9799# instead of -x
98100global(net.enableDNS="off")
99101
100102$template raw,"%msg:2:2048%\n"
101103
102- ruleset(name="common") {
103- # Forward everything
104- if ($fromhost-ip != "127.0.0.1" ) then action(type="omfwd"
105- protocol=tcp target=localhost port=30514
106- Template="RSYSLOG_SyslogProtocol23Format"
107- TCP_Framing="octet-counted" KeepAlive="on"
108- action.resumeRetryCount="-1"
109- queue.type="linkedlist" queue.size="50000")
104+ ruleset(name="alloy") {
105+ action(
106+ type="omfwd"
107+ protocol="udp" target="127.0.0.1" port="10515"
108+ Template="RSYSLOG_SyslogProtocol23Format"
109+ )
110110 *.* /dev/stdout; raw
111111}
112112
113113ruleset(name="withoutOrigin" parser="rsyslog.ciscoios") {
114- /* this ruleset uses the default parser which was
115- * created during module load
116- */
117- call common
114+ /* this ruleset uses the default parser which was
115+ * created during module load
116+ */
117+ call alloy
118118}
119119
120120parser(name="custom.ciscoios.withOrigin" type="pmciscoios"
121121 present.origin="on")
122122ruleset(name="withOrigin" parser="custom.ciscoios.withOrigin") {
123- /* this ruleset uses the parser defined immediately above */
124- call common
123+ /* this ruleset uses the parser defined immediately above */
124+ call alloy
125125}
126126```
127127
1281282 . Setup alloy agent with the following snippet (adjust to your setup):
129129
130- ```
131- // LOGS
132- loki.write "default" {
133- endpoint {
134- url = "loki:3100"
135- }
136- }
137-
138- loki.source.api "default" {
139- http {
140- listen_address = "0.0.0.0"
141- listen_port = 3500
142- }
143- forward_to = [
144- loki.process.limit.receiver,
145- ]
146- }
147- loki.process "limit" {
148- stage.limit {
149- rate = 10000
150- burst = 20000
151- drop = drop
152- by_label_name = "hostname"
153- }
154- forward_to = [
155- loki.write.default.receiver,
156- ]
157- }
158-
159-
160- // SYSLOG specific:
161- loki.source.syslog "default" {
162- listener {
163- address = "0.0.0.0:30514"
164- protocol = "tcp"
165- use_incoming_timestamp = true
166- labels = { job = "syslog" }
167- }
168-
169- forward_to = [loki.process.syslog.receiver]
170- relabel_rules = loki.relabel.syslog.rules
171- }
172-
173- loki.relabel "syslog" {
174- forward_to = []
175-
176- rule {
177- source_labels = ["__syslog_message_hostname"]
178- target_label = "sysname"
179- }
180- rule {
181- source_labels = ["__syslog_message_hostname"]
182- target_label = "instance"
183- }
184- rule {
185- source_labels = ["__syslog_message_app_name"]
186- target_label = "syslog_app_name"
187- }
188- rule {
189- source_labels = ["__syslog_message_severity"]
190- target_label = "level"
191- }
192- rule {
193- source_labels = ["__syslog_message_facility"]
194- target_label = "facility"
195- }
196- rule {
197- source_labels = ["__syslog_message_msg_id"]
198- target_label = "syslog_msg_id"
199- }
200- }
201- //cisco_rfc3164_logs
202- loki.process "syslog" {
203- stage.match {
204- // match only cisco unparsed logs like https://regex101.com/r/v0MyiB/6
205- // from ASA or NX-OS
206- selector = `{instance!=""} |~ "<\\d+>.+%.+"`
207- stage.regex {
208- expression = `<\d+?>((?P<sysname>[a-zA-Z0-9\-\.]+):)?(?P<date_and_other>.+): (?P<appname>%.+?): (?P<msg>.+)`
209- }
210- stage.labels {
211- values = {
212- sysname = "",
213- syslog_app_name = "appname",
214- }
215- }
216- stage.output {
217- source = "msg"
218- }
219- }
220-
221- forward_to = [loki.process.limit.receiver]
222- }
223-
224- ```
130+ https://github.com/grafana/integration-sample-apps/blob/main/sample-apps/snmp/jinja/templates/cloud-init-template.yaml#L202-L403
225131
2261323 . Setup syslog at the device side according to vendor docs
227133
0 commit comments