Syslog Collector¶
Overview¶
The Unified Assurance Syslog Collector microservice is part of the microservice event pipeline. It listens for syslogs from devices and creates a JSON structure which consists of all attributes from the syslog such as severity, facility, hostname, timestamp, etc. By default, the output topic is for the fcom-processor.
The Syslog Collector is expecting syslogs in the formats RFC3164 & RFC5424.
Prerequisites¶
-
A microservices cluster must be setup. Refer to Microservice Cluster Setup.
-
Apache Pulsar must be installed. Refer to Apache Pulsar microservice.
Setup¶
Standard Single Server deployment:
su - assure1
export NAMESPACE=a1-zone1-pri
export WEBFQDN=<Primary Presentation Web FQDN>
a1helm install syslog-collector assure1/syslog-collector -n $NAMESPACE --set global.imageRegistry=$WEBFQDN
Standard Multi-Server deployment and starts the microservice on a specific node:
su - assure1
export NAMESPACE=a1-zone1-pri
export WEBFQDN=<Primary Presentation Web FQDN>
export NODEFQDN=<Cluster Target Node FQDN>
a1helm install syslog-collector assure1/syslog-collector -n $NAMESPACE --set global.imageRegistry=$WEBFQDN --set nodeSelector."kubernetes\.io/hostname"=$NODEFQDN
Default Configuration¶
| Name | Value | Possible Values | Notes |
|---|---|---|---|
| LOG_LEVEL | INFO | FATAL, ERROR, WARN, INFO, DEBUG | Logging level used by application. |
| STREAM_INPUT | udp://:514 | Text, 255 characters | UDP socket port. |
| STREAM_OUTPUT | persistent://assure1/event/collection | Text, 255 characters | Apache Pulsar topic path. Topic at end of path may be any text value. |
| DISABLE_DNS | false | true, false | Enable or disable reverse DNS lookups for IPs from incoming syslog messages. |
| REDUNDANCY_POLL_PERIOD | 5 | Integer | How often the secondary service checks to see if the primary is online, in seconds. |
| REDUNDANCY_FAILOVER_THRESHOLD | 4 | Integer | The number of failed polls before the secondary becomes the active application. |
| REDUNDANCY_FALLBACK_THRESHOLD | 1 | Integer | The number of successful polls before the secondary goes back to sleep. |
Configurations can be changed by passing the values to the a1helm install prefixed with the configData parent key.
Example of setting the log level to DEBUG¶
a1helm install ... --set configData.LOG_LEVEL=DEBUG
Example of disabling DNS lookups¶
a1helm install ... --set-string configData.DISABLE_DNS="true"
Example of enabling redundancy¶
Redundancy will not be enabled by default. To enable this functionality, pass the following to the installation command:
a1helm install ... --set redundancy.enabled=true
Microservice self-metrics¶
The Unified Assurance Syslog Collector microservice exposes the following self-metrics to Prometheus.
| Metric Name | Type | Description |
|---|---|---|
| total_syslogs_processed | Counter | Number of syslogs processed |
| processing_time_per_syslog | Gauge | Processing time per syslog from receiving it to sending |
| receive_queue_length_udp | Gauge | Indicates the length of the receive queue waiting to be read in UDP buffer |
| receive_queue_length_udp6 | Gauge | Indicates the length of the receive queue waiting to be read in UDP6 buffer |