-
Administrator Guide
-
Collect Logs
-
Collect Logs: Apps & Services
- ESXi
- Routers network hardware
- Apple iOS and macOS
- Unix and BSD system logs
- C# and .NET (NLog)
- C# and .NET (log4net)
- Java logback
- Android
- Kubernetes cluster logging with rKubelog
- haproxy
- Advanced Unix logging tips
- Perl
- Windows
- Kubernetes
- Erlang
- Node.js
- Java log4j
- JavaScript
- Unicorn
- PHP
- Docker
- systemd
- Ruby on Rails
- MySQL
- Unix and BSD text log files (remote_syslog2)
- Redis
- Go
- Python
- Elixir
- IIS
- Embedded devices or proprietary systems
-
Collect Logs: Hosting Services
-
Collect Logs: Integrations
-
Manage Logs
- Groups
- Log flood detection
- Web Hooks
- Log colorization
- Linking to logs
- JSON search syntax
- Settings API
- Log destinations
- Alerts
- Command-line client
- Log filtering
- HTTP API
- Automatic S3 archive export
- Managing Senders
- Permanent log archives
- Mapping senders to groups
- Search syntax
- Click-to-search
- Log search API
- Event Viewer
-
Send Logs for Analytics
-
SolarWinds Users & Orgs
-
Support and Security
-
What's New
systemd
To send system logs from Linux distributions using systemd
(including newer releases of CentOS and CoreOS), follow the steps shown below
to forward output from journalctl to Papertrail.
For applications running in a Docker container, the options described on the Docker configuration page are recommended, but also see Docker and systemd below.
Forwarding system logs
Create a new unit/service that pipes output from journalctl into ncat
or socat by following the steps below:
- Create a new unit file named
papertrail.serviceunder/etc/systemd/system(root permissions required). - Paste the directives shown below, and replacing
logsNandXXXXXwith the values that appear under log destinations.
[Unit]
Description=Papertrail
After=systemd-journald.service
Requires=systemd-journald.service
[Service]
ExecStart=/bin/sh -c "journalctl -f | ncat --ssl logsN.papertrailapp.com XXXXX"
TimeoutStartSec=0
Restart=on-failure
RestartSec=5s
[Install]
WantedBy=multi-user.target- Run
$ sudo systemctl enable /etc/systemd/system/papertrail.serviceto enable the unit. - Then run
$ sudo systemctl start papertrail.serviceto start it. - Finally, use
$ journalctl -f -u papertrail.serviceto view the local logs and ensure the new unit has started successfully
Using socat
If ncat is not available, use socat instead by:
- saving papertrail-bundle.pem
into
/etc/papertrail-bundle.pem - changing
ExecStartto:
ExecStart=/bin/sh -c "journalctl -f | socat - SSL:logsN.papertrailapp.com:XXXXX,cafile=/etc/papertrail-bundle.pem"Again, replace logsN and XXXXX with the values that appear under log destinations.
Docker and systemd
When using systemd to send logs from Docker containers, as on CoreOS, the solutions above will result in all Docker logs coming in under the program name docker rather than the service name. If sending logs from containers via systemd is desirable, try the solution created by Papertrail customer C2FO:
journalctl -o json -f | jq -r --unbuffered '"\(.__REALTIME_TIMESTAMP | tonumber / 1000000) \(._HOSTNAME) \(._SYSTEMD_UNIT // .UNIT // .SYSLOG_IDENTIFIER): \(.msgtype = (.MESSAGE | type) | if .msgtype == "array" then (.MESSAGE | implode) else .MESSAGE end)"' | awk '{ $1=strftime("%b %d %T", $1); print $0; fflush(); }'piped to ncat or socat. This is easiest to place in a separate script, but it can also be placed directly in an ExecStart directive. It makes use of the JSON format for journalctl logs, transformed to a syslog string using jq and awk. There’s also an option to set up coproc to better detect sending failures.
The scripts are not supported under any SolarWinds support program or service. The scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.