OpenStack rsyslog client

Ansible role to deploy rsyslog for client use. This role will ship any and all logs discovered in the rsyslog_client_log_dir directory to any valid rsyslog target. The role was designed to be used by OpenStack-Ansible by leveraging multiple logging hosts via the rsyslog_all group. If that inventory group is not defined additional log shipping targets can be defined using rsyslog_client_user_defined_targets

Table of contents

• Centralized logging
  • Finding logs

Default variables

## APT Cache Options
cache_timeout: 600

# Set the package install state for distribution packages
# Options are 'present' and 'latest'
rsyslog_client_package_state: "latest"

rsyslog_client_spool_directory: /var/spool/rsyslog

# Set the `rsyslog_client_log_dir` variable in to override log file
# discovery process. This will force the logs from a given directory
# to be shipped using rsyslog.
# rsyslog_client_log_dir: /var/log/project

# Set the `rsyslog_client_log_files` variable in list format to skip
# log discovery all together and ship only log files that are explicitly
# stated.
# rsyslog_client_log_files:
#   - /var/log/project/logfile1.log
#   - /var/log/project/logfile2.log

# Name of the configuration file that will be used client side.
rsyslog_client_config_name: 99-rsyslog-client.conf

# provides UDP syslog reception
rsyslog_client_udp_reception: true
rsyslog_client_udp_port: 514

# provides TCP syslog reception
rsyslog_client_tcp_reception: false
rsyslog_client_tcp_port: 514

# Define the log files list as empty
rsyslog_client_log_files: []

rsyslog_client_log_rotate_file: os_aggregate_storage
rsyslog_client_log_rotate_options:
  - copytruncate
  - weekly
  - missingok
  - rotate 14
  - compress
  - dateext
  - maxage 60
  - notifempty
  - nocreate
rsyslog_client_log_rotate_scripts:
  - name: postrotate
    content: "restart rsyslog 2>&1 || true"

# Set the `rsyslog_client_user_defined_targets` to define specific log targets.
# This option will allow you to define multiple log targets with different templates
# and options. The value of this variable is a list of hashes with the following
# required options: name, proto, port, hostname. This variable also has the following
# optional options: template, action_options. If you set `action_options` make sure you
# separate options inline with a ";".
## Example
# rsyslog_client_user_defined_targets:
#   - name: "splunk1"
#     proto: "tcp"
#     port: "20000"
#     hostname: "tcp.hostname.data.splunkstorm.com"
#   - name: "loggly1"
#     proto: "udp"
#     port: "514"
#     hostname: "logs-01.loggly.com"
#     template: '$template LogglyFormat,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [TOKEN@41058 tag=\"TAG\"] %msg%\n"'
#     action_options: 'LogglyFormat'

Required variables

None

Example playbook

- name: Install rsyslog 
  hosts: rsyslog
  user: root
  roles:
    - role: "rsyslog_client"
      rsyslog_client_log_rotate_file: test_log_rotate
      rsyslog_client_log_dir: "/var/log"
      rsyslog_client_config_name: "99-test-rsyslog-client.conf"
      rsyslog_client_log_files:
        - /var/log/dmesg
        - /var/log/udev