Merge pull request 'Centralisation des journaux (pas encore Elastic)' (#40) from logs-first-phase into master
Reviewed-on: Aurore/ansible#40pull/39/head
jeltz
3 years ago
commit
11578494ec
@ -0,0 +1,9 @@
|
||||
---
|
||||
rsyslog_collector_base_dir: /var/log/remote
|
||||
rsyslog_inputs:
|
||||
- proto: relp
|
||||
port: 20514
|
||||
- proto: udp
|
||||
port: 514
|
||||
rsyslog_outputs: []
|
||||
...
|
||||
@ -0,0 +1,5 @@
|
||||
---
|
||||
- hosts: log.adm.auro.re
|
||||
roles:
|
||||
- rsyslog_collector
|
||||
...
|
||||
@ -0,0 +1,7 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
log_format extended
|
||||
'$remote_addr - $http_x_forwarded_for - $connection '
|
||||
'$remote_user [$time_local] '
|
||||
'"$host" "$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent"';
|
||||
@ -0,0 +1,4 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
access_log syslog:server=unix:/dev/log,tag=nginx,nohostname,severity=info extended;
|
||||
error_log syslog:server=unix:/dev/log,tag=nginx,nohostname,severity=error;
|
||||
@ -0,0 +1,7 @@
|
||||
---
|
||||
rsyslog_inputs: []
|
||||
rsyslog_collector_base_dir: /var/log/remote
|
||||
rsyslog_collector_rotate_path: /usr/local/sbin/rotate_remote_logs
|
||||
rsyslog_collector_keep_days: 0
|
||||
rsyslog_collector_compress_days: 1
|
||||
...
|
||||
@ -0,0 +1,60 @@
|
||||
#!/usr/bin/env python3
|
||||
import argparse
|
||||
import datetime
|
||||
import logging
|
||||
import pathlib
|
||||
import subprocess
|
||||
|
||||
|
||||
def compress_file(filename):
|
||||
subprocess.run(["xz", "-z", str(filename)])
|
||||
|
||||
|
||||
def find_files(base_dir, extension, days):
|
||||
delta = datetime.timedelta(days=days)
|
||||
now = datetime.datetime.now()
|
||||
for path in base_dir.rglob(f"*{extension}"):
|
||||
stem = path.name.removesuffix(extension)
|
||||
date = datetime.datetime.fromisoformat(stem)
|
||||
if date < now - delta:
|
||||
yield path
|
||||
|
||||
|
||||
def compress_logs(base_dir, days):
|
||||
for path in find_files(base_dir, ".log", days):
|
||||
logging.info("Compressing log file %s", str(path))
|
||||
compress_file(path)
|
||||
|
||||
|
||||
def remove_logs(base_dir, days):
|
||||
for path in find_files(base_dir, ".log.xz", days):
|
||||
logging.info("Removing log file %s", str(path))
|
||||
path.unlink()
|
||||
|
||||
|
||||
def main():
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("--compress-days", type=int, default=0)
|
||||
parser.add_argument("--keep-days", type=int, default=0)
|
||||
parser.add_argument(
|
||||
"--base-dir", type=pathlib.Path, default="/var/log/remote"
|
||||
)
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
logging.basicConfig(format="%(levelname)s %(message)s", level=logging.INFO)
|
||||
|
||||
logging.info("Rotate script started")
|
||||
|
||||
if args.compress_days > 0:
|
||||
compress_logs(args.base_dir, args.compress_days)
|
||||
|
||||
if args.keep_days > 0:
|
||||
remove_logs(args.base_dir, args.keep_days)
|
||||
|
||||
logging.info("Rotate script done")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@ -0,0 +1,5 @@
|
||||
---
|
||||
- name: Run systemd daemon-reload
|
||||
systemd:
|
||||
daemon_reload: true
|
||||
...
|
||||
@ -0,0 +1,4 @@
|
||||
---
|
||||
dependencies:
|
||||
- role: rsyslog_common
|
||||
...
|
||||
@ -0,0 +1,57 @@
|
||||
---
|
||||
- name: Install rsyslog-relp if needed
|
||||
become: true
|
||||
apt:
|
||||
name: rsyslog-relp
|
||||
state: present
|
||||
when: "rsyslog_inputs | selectattr('proto', 'eq', 'relp') | list"
|
||||
|
||||
- name: Ensure log storage directory exists
|
||||
become: true
|
||||
file:
|
||||
path: "{{ rsyslog_collector_base_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: adm
|
||||
mode: u=rwx,g=rwx,o=
|
||||
|
||||
- name: Deploy rsyslog input configuration file
|
||||
become: true
|
||||
template:
|
||||
src: 20-collector.conf.j2
|
||||
dest: /etc/rsyslog.d/20-collector.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rw,g=r,o=r
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: Install rotate script
|
||||
become: true
|
||||
copy:
|
||||
src: rotate
|
||||
dest: "{{ rsyslog_collector_rotate_path }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rwx,g=rx,o=
|
||||
|
||||
- name: Install timer and service for rotate script
|
||||
become: true
|
||||
template:
|
||||
src: "{{ item }}.j2"
|
||||
dest: "/etc/systemd/system/{{ item }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rw,g=r,o=
|
||||
loop:
|
||||
- rotate-remote-logs.timer
|
||||
- rotate-remote-logs.service
|
||||
notify:
|
||||
- Run systemd daemon-reload
|
||||
|
||||
- name: Enable timer for log rotation
|
||||
become: true
|
||||
systemd:
|
||||
name: rotate-remote-logs.timer
|
||||
enabled: true
|
||||
state: started
|
||||
...
|
||||
@ -0,0 +1,54 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
module(load="mmrm1stspace")
|
||||
|
||||
{%
|
||||
set input_modules = {
|
||||
"relp": "imrelp",
|
||||
"udp": "imudp",
|
||||
}
|
||||
%}
|
||||
|
||||
{%
|
||||
for module in rsyslog_inputs
|
||||
| map(attribute="proto")
|
||||
| map("extract", input_modules)
|
||||
| list
|
||||
| unique
|
||||
%}
|
||||
module(load="{{ module }}")
|
||||
{% endfor %}
|
||||
|
||||
template(name="incomingFilename" type="list") {
|
||||
constant(value="{{ rsyslog_collector_base_dir }}/")
|
||||
property(name="fromhost-ip")
|
||||
constant(value="/")
|
||||
property(name="timegenerated" dateFormat="year")
|
||||
constant(value="-")
|
||||
property(name="timegenerated" dateFormat="month")
|
||||
constant(value="-")
|
||||
property(name="timegenerated" dateFormat="day")
|
||||
constant(value=".log")
|
||||
}
|
||||
|
||||
ruleset(name="handleIncomingLogs") {
|
||||
action(type="mmrm1stspace")
|
||||
action(
|
||||
type="omfile"
|
||||
dynaFile="incomingFilename"
|
||||
template="RSYSLOG_FileFormat"
|
||||
)
|
||||
call sendLogsToRemote
|
||||
}
|
||||
|
||||
# TODO: add protocol-specific options (eg. TLS)
|
||||
{% for input in rsyslog_inputs %}
|
||||
input(
|
||||
type="{{ input_modules[input.proto] }}"
|
||||
{% if "address" in input %}
|
||||
address="{{ input.address }}"
|
||||
{% endif %}
|
||||
port="{{ input.port }}"
|
||||
ruleset="handleIncomingLogs"
|
||||
)
|
||||
{% endfor %}
|
||||
@ -0,0 +1,12 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
[Unit]
|
||||
Description=Rotate remote logs
|
||||
|
||||
[Service]
|
||||
User=root
|
||||
Type=simple
|
||||
ExecStart={{ rsyslog_collector_rotate_path }} \
|
||||
--base-dir {{ rsyslog_collector_base_dir }} \
|
||||
--compress-days {{ rsyslog_collector_compress_days }} \
|
||||
--keep-days {{ rsyslog_collector_keep_days }}
|
||||
@ -0,0 +1,10 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
[Unit]
|
||||
Description=Rotate remote logs daily
|
||||
|
||||
[Timer]
|
||||
OnCalendar=daily
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@ -0,0 +1,3 @@
|
||||
---
|
||||
rsyslog_outputs: []
|
||||
...
|
||||
@ -0,0 +1,13 @@
|
||||
---
|
||||
- name: Restart rsyslog
|
||||
become: true
|
||||
systemd:
|
||||
name: rsyslog.service
|
||||
state: restarted
|
||||
|
||||
- name: Restart systemd-journald
|
||||
become: true
|
||||
systemd:
|
||||
name: systemd-journald.service
|
||||
state: restarted
|
||||
...
|
||||
@ -0,0 +1,60 @@
|
||||
---
|
||||
- name: Install rsyslog
|
||||
become: true
|
||||
apt:
|
||||
name: rsyslog
|
||||
state: present
|
||||
|
||||
- name: Install rsyslog modules if needed
|
||||
become: true
|
||||
apt:
|
||||
name: "{{ item.pkg }}"
|
||||
state: present
|
||||
when: "rsyslog_outputs | selectattr('proto', 'eq', item.proto) | list"
|
||||
loop:
|
||||
- proto: relp
|
||||
pkg: rsyslog-relp
|
||||
- proto: redis
|
||||
pkg: rsyslog-hiredis
|
||||
|
||||
- name: Deploy main rsyslog configuration
|
||||
become: true
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rw,g=r,o=r
|
||||
loop:
|
||||
- src: rsyslog.conf.j2
|
||||
dest: /etc/rsyslog.conf
|
||||
- src: 10-common.conf.j2
|
||||
dest: /etc/rsyslog.d/10-common.conf
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: Create journald.conf.d directory
|
||||
become: true
|
||||
file:
|
||||
path: /etc/systemd/journald.conf.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
|
||||
- name: Deploy journald configuration
|
||||
become: true
|
||||
template:
|
||||
src: forward-syslog.conf.j2
|
||||
dest: /etc/systemd/journald.conf.d/forward-syslog.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rw,g=r,o=r
|
||||
notify: Restart systemd-journald
|
||||
|
||||
- name: Enable rsyslog service
|
||||
become: true
|
||||
systemd:
|
||||
name: rsyslog.service
|
||||
state: started
|
||||
enabled: true
|
||||
...
|
||||
@ -0,0 +1,105 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
{%
|
||||
set output_modules = {
|
||||
"relp": "omrelp",
|
||||
"udp": "omfwd",
|
||||
"redis": "omhiredis",
|
||||
}
|
||||
%}
|
||||
|
||||
global(
|
||||
workDirectory="/var/spool/rsyslog"
|
||||
preserveFQDN="on"
|
||||
)
|
||||
|
||||
# Collect logs via /dev/log
|
||||
module(load="imuxsock")
|
||||
|
||||
# Collect kernel logs
|
||||
module(load="imklog")
|
||||
|
||||
# Parse CEE logs
|
||||
module(load="mmjsonparse")
|
||||
|
||||
# Load export modules
|
||||
{%
|
||||
for module in rsyslog_outputs
|
||||
| map(attribute="proto")
|
||||
| map("extract", output_modules)
|
||||
| list
|
||||
| unique
|
||||
%}
|
||||
module(load="{{ module }}")
|
||||
{% endfor %}
|
||||
|
||||
# FIXME: Attention, il faut voir si rsyslog arrive bien à créer
|
||||
# les fichiers de plusieurs jours (le 1er est peut-être crée avant
|
||||
# de dropper les privilèges, mais les suivants je pense pas).
|
||||
module(
|
||||
load="builtin:omfile"
|
||||
# Format avec dates précises
|
||||
template="RSYSLOG_FileFormat"
|
||||
fileOwner="root"
|
||||
fileGroup="adm"
|
||||
fileCreateMode="0640"
|
||||
dirCreateMode="0755"
|
||||
)
|
||||
|
||||
template(name="templateJson" type="list" option.jsonf="on") {
|
||||
property(outname="hostname_reported" name="hostname" format="jsonf")
|
||||
property(outname="src" name="fromhost-ip" format="jsonf")
|
||||
property(outname="facility" name="syslogfacility-text" format="jsonf")
|
||||
property(outname="program" name="programname" format="jsonf")
|
||||
property(outname="pid" name="procid" format="jsonf")
|
||||
property(outname="time_reported" name="timereported" format="jsonf"
|
||||
dateformat="rfc3339")
|
||||
property(outname="time_generated" name="timegenerated" format="jsonf"
|
||||
dateformat="rfc3339")
|
||||
property(outname="message" name="msg" format="jsonf")
|
||||
}
|
||||
|
||||
ruleset(name="sendLogsToDisk") {
|
||||
auth,authpriv.* action(type="omfile" file="/var/log/auth.log")
|
||||
mail.* action(type="omfile" file="/var/log/mail.log" sync="off")
|
||||
kern.* action(type="omfile" file="/var/log/kern.log")
|
||||
*.*;auth,authpriv,mail,kern.none action(type="omfile"
|
||||
file="/var/log/syslog.log" sync="off")
|
||||
}
|
||||
|
||||
# Send logs to remote collector(s)
|
||||
ruleset(name="sendLogsToRemote") {
|
||||
{% for output in rsyslog_outputs %}
|
||||
action(
|
||||
type="{{ output_modules[output.proto] }}"
|
||||
|
||||
{% if output_modules[output.proto] == "omfwd" %}
|
||||
protocol="{{ output.proto }}"
|
||||
target="{{ output.address }}"
|
||||
port="{{ output.port }}"
|
||||
{% elif output_modules[output.proto] == "omhiredis" %}
|
||||
server="{{ output.address }}"
|
||||
serverport="{{ output.port }}"
|
||||
mode="publish"
|
||||
key="{{ output.key }}"
|
||||
template="templateJson"
|
||||
{% if output.password is defined %}
|
||||
serverpassword="{{ output.password }}"
|
||||
{% endif %}
|
||||
{% elif output_modules[output.proto] == "omrelp" %}
|
||||
target="{{ output.address }}"
|
||||
port="{{ output.port }}"
|
||||
{% endif %}
|
||||
|
||||
{% if loop.index > 1 and output.fallback %}
|
||||
action.execOnlyWhenPreviousIsSuspended="on"
|
||||
{% endif %}
|
||||
)
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
# Send local logs to files (useful for debugging or if the collector is down)
|
||||
call sendLogsToDisk
|
||||
|
||||
# Send local logs to the remote collector
|
||||
call sendLogsToRemote
|
||||
@ -0,0 +1,5 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
[Journal]
|
||||
ForwardToSyslog=yes
|
||||
MaxLevelSyslog=debug
|
||||
@ -0,0 +1,3 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
include(file="/etc/rsyslog.d/*.conf")
|
||||
Loading…
Reference in New Issue