@@ -91,137 +91,43 @@ In order to get syslog messages you need to do the following (example for cisco
91
91
module(load="imudp")
92
92
#https://www.rsyslog.com/doc/master/configuration/modules/pmciscoios.html
93
93
module(load="pmciscoios")
94
- # Pick your port to taste
95
- input(type="imudp" port="30514" ruleset="withOrigin")
96
- timezone(id="<yourtimezone>" offset="00:00")
94
+
95
+ input(type="imudp" port="10516" ruleset="withOrigin")
96
+ input(type="imudp" port="10517" ruleset="withoutOrigin")
97
+
98
+ timezone(id="GMT" offset="+00:00")
97
99
# instead of -x
98
100
global(net.enableDNS="off")
99
101
100
102
$template raw,"%msg:2:2048%\n"
101
103
102
- ruleset(name="common") {
103
- # Forward everything
104
- if ($fromhost-ip != "127.0.0.1" ) then action(type="omfwd"
105
- protocol=tcp target=localhost port=30514
106
- Template="RSYSLOG_SyslogProtocol23Format"
107
- TCP_Framing="octet-counted" KeepAlive="on"
108
- action.resumeRetryCount="-1"
109
- queue.type="linkedlist" queue.size="50000")
104
+ ruleset(name="alloy") {
105
+ action(
106
+ type="omfwd"
107
+ protocol="udp" target="127.0.0.1" port="10515"
108
+ Template="RSYSLOG_SyslogProtocol23Format"
109
+ )
110
110
*.* /dev/stdout; raw
111
111
}
112
112
113
113
ruleset(name="withoutOrigin" parser="rsyslog.ciscoios") {
114
- /* this ruleset uses the default parser which was
115
- * created during module load
116
- */
117
- call common
114
+ /* this ruleset uses the default parser which was
115
+ * created during module load
116
+ */
117
+ call alloy
118
118
}
119
119
120
120
parser(name="custom.ciscoios.withOrigin" type="pmciscoios"
121
121
present.origin="on")
122
122
ruleset(name="withOrigin" parser="custom.ciscoios.withOrigin") {
123
- /* this ruleset uses the parser defined immediately above */
124
- call common
123
+ /* this ruleset uses the parser defined immediately above */
124
+ call alloy
125
125
}
126
126
```
127
127
128
128
2 . Setup alloy agent with the following snippet (adjust to your setup):
129
129
130
- ```
131
- // LOGS
132
- loki.write "default" {
133
- endpoint {
134
- url = "loki:3100"
135
- }
136
- }
137
-
138
- loki.source.api "default" {
139
- http {
140
- listen_address = "0.0.0.0"
141
- listen_port = 3500
142
- }
143
- forward_to = [
144
- loki.process.limit.receiver,
145
- ]
146
- }
147
- loki.process "limit" {
148
- stage.limit {
149
- rate = 10000
150
- burst = 20000
151
- drop = drop
152
- by_label_name = "hostname"
153
- }
154
- forward_to = [
155
- loki.write.default.receiver,
156
- ]
157
- }
158
-
159
-
160
- // SYSLOG specific:
161
- loki.source.syslog "default" {
162
- listener {
163
- address = "0.0.0.0:30514"
164
- protocol = "tcp"
165
- use_incoming_timestamp = true
166
- labels = { job = "syslog" }
167
- }
168
-
169
- forward_to = [loki.process.syslog.receiver]
170
- relabel_rules = loki.relabel.syslog.rules
171
- }
172
-
173
- loki.relabel "syslog" {
174
- forward_to = []
175
-
176
- rule {
177
- source_labels = ["__syslog_message_hostname"]
178
- target_label = "sysname"
179
- }
180
- rule {
181
- source_labels = ["__syslog_message_hostname"]
182
- target_label = "instance"
183
- }
184
- rule {
185
- source_labels = ["__syslog_message_app_name"]
186
- target_label = "syslog_app_name"
187
- }
188
- rule {
189
- source_labels = ["__syslog_message_severity"]
190
- target_label = "level"
191
- }
192
- rule {
193
- source_labels = ["__syslog_message_facility"]
194
- target_label = "facility"
195
- }
196
- rule {
197
- source_labels = ["__syslog_message_msg_id"]
198
- target_label = "syslog_msg_id"
199
- }
200
- }
201
- //cisco_rfc3164_logs
202
- loki.process "syslog" {
203
- stage.match {
204
- // match only cisco unparsed logs like https://regex101.com/r/v0MyiB/6
205
- // from ASA or NX-OS
206
- selector = `{instance!=""} |~ "<\\d+>.+%.+"`
207
- stage.regex {
208
- expression = `<\d+?>((?P<sysname>[a-zA-Z0-9\-\.]+):)?(?P<date_and_other>.+): (?P<appname>%.+?): (?P<msg>.+)`
209
- }
210
- stage.labels {
211
- values = {
212
- sysname = "",
213
- syslog_app_name = "appname",
214
- }
215
- }
216
- stage.output {
217
- source = "msg"
218
- }
219
- }
220
-
221
- forward_to = [loki.process.limit.receiver]
222
- }
223
-
224
- ```
130
+ https://github.com/grafana/integration-sample-apps/blob/main/sample-apps/snmp/jinja/templates/cloud-init-template.yaml#L202-L403
225
131
226
132
3 . Setup syslog at the device side according to vendor docs
227
133
0 commit comments