Logging
Opsview Monitor uses centralized logging so all components will log to the same syslog system. With a suitable setup, this means you can view log messages across multiple hosts in a single location.
By default Opsview Monitor uses rsyslog
for log messages (syslog-ng
may be used instead) and logrotate
for log rotation. To allow simple separation of Opsview log messages from other parts of the operating system, Opsview will log using the local6 facility.
This page explains the default configuration used by Opsview and some example changes that you can make for your system.
Installation Copied
When Opsview is installed, it will copy Opsview syslog configuration file 99-opsview.conf
to /etc/syslog-ng/conf.d
and /etc/rsyslog.d/conf.d
, depending on which software is installed.
If you have both types of syslog software installed, you may get conflicts.
Note
The configuration file will be re-installed on upgrade.
By default, Opsview will log to the system’s main log file as well as /var/log/opsview/opsview.log
.
Furthermore, logrotate
will rotate the /var/log/opsview/opsview.log
file.
rsyslog Copied
As part of the opsview-setup package, Opsview will configure rsyslogd by placing the configuration into /etc/rsyslog.d/99-opsview.conf
.
The default configuration is for all log messages to be written to /var/log/opsview/opsview.log
.
local6.* -/var/log/opsview/opsview.log
You can make changes to this file, but you will need to restart the rsyslog service. Be aware that this file will be overwritten on an upgrade of opsview-setup
.
Examples Copied
Separating destinations Copied
This example shows how to use separate log files based on the component, or the log level.
# This is an example for logging components to separate log files (Perl Components)
if $programname == 'opsview-datastore' then
{
/var/log/opsview/datastore.log
~ #<- Stops it logging to the default log file and sends it to the new log file for this component
#remove this if you want the log to go to both log files
}
# This is an example for logging components to separate log files (Python Components)
:msg, contains, "orchestrator" -/var/log/opsview/orchestrator.log ~
# Can dupe this for every component wanting to be sent to a different log file
# Default facility for Opsview Components
local6.* -/var/log/opsview/opsview.log #<-Logs all opsview logs to the opsview log file that use local6 facility
# Write errors/warnings to separate files (Perl Components)
local6.err -/var/log/opsview/opsview.err
local6.warn -/var/log/opsview/opsview.warn
# Write errors/warnings to separate files (Python Components)
:msg, contains, "ERR" -/var/log/opsview/opsview.err
:msg, contains, "WARNING" -/var/log/opsview/opsview.warn
Separating destinations based on components and log levels Copied
To log error and warning messages from a particular component to separate log file:
# For Perl components
if $programname == 'opsview-datastore' and $syslogseverity-text == 'err' then /var/log/opsview/datastore.err
if $programname == 'opsview-datastore' and $syslogseverity-text == 'err' then /var/log/opsview/datastore.warn
# For Python components
if $msg == 'orchestrator' and $msg == 'ERR' then /var/log/opsview/orchestrator.err
if $msg == 'orchestrator' and $msg == 'WARNING' then /var/log/opsview/orchestrator.warn
Forwarding to remote syslog server Copied
To send syslog messages to a remote server use: (this would for example be used on a collector to send the log messages to the orchestrator server)
# Add the following line to 99-opsview.conf
local6.* @@'IP:PORT' # Use for use with TCP
local6.* @'IP:PORT' # Use for use with UDP
Changing Permissions Copied
To change permissions for the log file so that everyone can read but only syslog and root can write to the log file, add the following to the top:
# Make readable by all
$FileCreateMode 0644
$DirCreateMode 0755
$Umask 0022
Troubleshooting Copied
Directory is not created Copied
Restarting rsyslog should create the directory for the log files, if it doesn’t already exist:
service rsyslog restart
In some cases, you may also need to reboot the machine:
reboot
Log rotation Copied
As part of the opsview-setup package, Opsview will configure logrotate by placing the configuration into /etc/logrotate.d/opsview-logging
.
The default is to rotate logs every day for 7 days.
Note
As part of an upgrade, this configuration file will be overwritten.
syslog-ng Copied
Switching to syslog-ng after installing Opsview Copied
If you install syslog-ng after Opsview has been installed, you must configure syslog-ng manually.
Firstly, install and configure syslog-ng
as desired. Then run as root:
/opt/opsview/installer/setup_syslog
This will now log Opsview messages to /var/log/opsview/opsview.log
. To test, run:
logger -p local6.notice "Test message from Opsview"
Check the log file to confirm this has been setup correctly.
Webserver logging Copied
By default Opsview Monitor logs all web access separately, see Webserver Logging for more information.