[Puppet Users] send all puppet messages to rsyslog

2015-07-21 Thread eric odell
How to get all puppet agent/master logs to rsyslog? intend to ship all 
puppet agent/master messages to central loghost and parse with logstash and 
ship to elasticsearch. Currently puppet logs some messages to 
/var/log/messages via rsyslog  while puppet daemons write directly to 
/var/log/puppet/*.

puppet client/master syslogfacility  set to daemon:

puppet master --configprint syslogfacility
daemon

Thought that setting rsyslog to catch all logs with syslog facility of 
daemon:

grep daemon /etc/rsyslog.conf 
daemon.*/var/log/daemon

should do the trick but this logs very little in /var/log/daemon while 
puppet continues to log most everything to /var/log/puppet/*

Also puppet logging to rsyslog may be poor choice when dealing with long 
multiline error messages...
Have considered running logstash directly on each puppet node/master but 
want to see if I can ship all puppet logs to central rsyslog server which 
already has logstash running...

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/f0581c8f-b08d-4668-960a-8bf649b2522e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [Puppet Users] send all puppet messages to rsyslog

2015-07-21 Thread Hristo Mohamed
For the puppet agent, you can always try tdis rsyslog syntax:
if $programname == 'puppet-agent' then /var/log/puppet.log
if $programname == 'puppet-agent' then ~

Same for the master process.

On Tue, Jul 21, 2015 at 11:29 PM, eric odell cirell...@gmail.com wrote:

 How to get all puppet agent/master logs to rsyslog? intend to ship all
 puppet agent/master messages to central loghost and parse with logstash and
 ship to elasticsearch. Currently puppet logs some messages to
 /var/log/messages via rsyslog  while puppet daemons write directly to
 /var/log/puppet/*.

 puppet client/master syslogfacility  set to daemon:

 puppet master --configprint syslogfacility
 daemon

 Thought that setting rsyslog to catch all logs with syslog facility of
 daemon:

 grep daemon /etc/rsyslog.conf
 daemon.*/var/log/daemon

 should do the trick but this logs very little in /var/log/daemon while
 puppet continues to log most everything to /var/log/puppet/*

 Also puppet logging to rsyslog may be poor choice when dealing with long
 multiline error messages...
 Have considered running logstash directly on each puppet node/master but
 want to see if I can ship all puppet logs to central rsyslog server which
 already has logstash running...

  --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To unsubscribe from this group and stop receiving emails from it, send an
 email to puppet-users+unsubscr...@googlegroups.com.
 To view this discussion on the web visit
 https://groups.google.com/d/msgid/puppet-users/f0581c8f-b08d-4668-960a-8bf649b2522e%40googlegroups.com
 https://groups.google.com/d/msgid/puppet-users/f0581c8f-b08d-4668-960a-8bf649b2522e%40googlegroups.com?utm_medium=emailutm_source=footer
 .
 For more options, visit https://groups.google.com/d/optout.


-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/CALuoJ650fngV5YtJCsBwMsNzao3t4uKG2WntU3mBWQws_KDy9A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.