Logging

Opsview Monitor uses centralized logging so all components will log to the same syslog system. With a suitable setup, this means you can view log messages across multiple hosts in a single location.

By default Opsview Monitor uses rsyslog for log messages (syslog-ng may be used instead) and logrotate for log rotation. To allow simple separation of Opsview log messages from other parts of the operating system, Opsview will log using the local6 facility.

This page explains the default configuration used by Opsview and some example changes that you can make for your system.

Installation Copied

When Opsview is installed, it will copy Opsview syslog configuration file 99-opsview.conf to /etc/syslog-ng/conf.d and /etc/rsyslog.d/conf.d, depending on which software is installed.

If you have both types of syslog software installed, you may get conflicts.

Note

The configuration file will be re-installed on upgrade.

By default, Opsview will log to the system’s main log file as well as /var/log/opsview/opsview.log.

Furthermore, logrotate will rotate the /var/log/opsview/opsview.log file.

rsyslog Copied

As part of the opsview-setup package, Opsview will configure rsyslogd by placing the configuration into /etc/rsyslog.d/99-opsview.conf.

The default configuration is for all log messages to be written to /var/log/opsview/opsview.log.

local6.*                -/var/log/opsview/opsview.log

You can make changes to this file, but you will need to restart the rsyslog service. Be aware that this file will be overwritten on an upgrade of opsview-setup.

Examples Copied

Separating destinations Copied

This example shows how to use separate log files based on the component, or the log level.

# This is an example for logging components to separate log files (Perl Components)
if $programname == 'opsview-datastore' then
{
    /var/log/opsview/datastore.log
    ~                                               #<- Stops it logging to the default log file and sends it to the new log file for this component
                                                    #remove this if you want the log to go to both log files
}  
 
# This is an example for logging components to separate log files (Python Components)
:msg, contains, "orchestrator" -/var/log/opsview/orchestrator.log ~
  
# Can dupe this for every component wanting to be sent to a different log file
# Default facility for Opsview Components 
local6.*                        -/var/log/opsview/opsview.log       #<-Logs all opsview logs to the opsview log file that use local6 facility
  
# Write errors/warnings to separate files (Perl Components)
local6.err                      -/var/log/opsview/opsview.err
local6.warn                     -/var/log/opsview/opsview.warn
  
# Write errors/warnings to separate files (Python Components)
:msg, contains, "ERR"           -/var/log/opsview/opsview.err
:msg, contains, "WARNING"       -/var/log/opsview/opsview.warn

Separating destinations based on components and log levels Copied

To log error and warning messages from a particular component to separate log file:

# For Perl components
if $programname == 'opsview-datastore' and $syslogseverity-text == 'err' then /var/log/opsview/datastore.err
if $programname == 'opsview-datastore' and $syslogseverity-text == 'err' then /var/log/opsview/datastore.warn
  
# For Python components
if $msg == 'orchestrator' and $msg == 'ERR' then /var/log/opsview/orchestrator.err
if $msg == 'orchestrator' and $msg == 'WARNING' then /var/log/opsview/orchestrator.warn

Forwarding to remote syslog server Copied

To send syslog messages to a remote server use: (this would for example be used on a collector to send the log messages to the orchestrator server)

# Add the following line to 99-opsview.conf
local6.* @@'IP:PORT'        # Use for use with TCP
local6.* @'IP:PORT'         # Use for use with UDP

Changing Permissions Copied

To change permissions for the log file so that everyone can read but only syslog and root can write to the log file, add the following to the top:

# Make readable by all
$FileCreateMode 0644
$DirCreateMode 0755
$Umask 0022

Troubleshooting Copied

Directory is not created Copied

Restarting rsyslog should create the directory for the log files, if it doesn’t already exist:

service rsyslog restart

In some cases, you may also need to reboot the machine:

reboot

Log rotation Copied

As part of the opsview-setup package, Opsview will configure logrotate by placing the configuration into /etc/logrotate.d/opsview-logging.

The default is to rotate logs every day for 7 days.

Note

As part of an upgrade, this configuration file will be overwritten.

syslog-ng Copied

Switching to syslog-ng after installing Opsview Copied

If you install syslog-ng after Opsview has been installed, you must configure syslog-ng manually.

Firstly, install and configure syslog-ng as desired. Then run as root:

/opt/opsview/installer/setup_syslog

This will now log Opsview messages to /var/log/opsview/opsview.log. To test, run:

logger -p local6.notice "Test message from Opsview"

Check the log file to confirm this has been setup correctly.

Webserver logging Copied

By default Opsview Monitor logs all web access separately, see Webserver Logging for more information.

["Opsview"] ["User Guide"]

Was this topic helpful?