Simple Log Service:Use the syslog protocol to upload logs

Limits

• Syslog logs must be stored based on the RFC 5424 protocol. For other Syslog protocols, refer to Collect syslogs.

• The maximum size of each log is 64 KB.

• Transport Layer Security (TLS) 1.2 must be used to ensure the security of data transmission.

Configurations

If you upload logs by using the syslog protocol, you must specify the endpoint to which you want to upload the logs. The address is in the <Project name>.<Log Service endpoint>:<Syslog protocol port number> format. Example: test-project-1.cn-hangzhou-intranet.log.aliyuncs.com:10009. Specify an endpoint based on the region where your SImple Log Service project resides. For more information, see Endpoints. The syslog port is 10009. You must also specify a Simple Log Service project, a Logstore, and an AccessKey pair in the STRUCTURED-DATA field. The following table describes the parameters.

Example: Use the syslog-ng utility to upload syslog logs to Simple Log Service

1. Open the syslog-ng configuration file.

   The default path of the syslog-ng configuration file is /etc/syslog-ng/syslog-ng.conf.

2. Configure the following settings and append the configurations to your syslog-ng configuration file:

   ### Syslog-ng Logging Config for LogService ### 
   template LogServiceFormat { 
       template("<${PRI}>1 ${ISODATE} ${HOST:--} ${PROGRAM:--} ${PID:--} ${MSGID:--} [logservice project=\"test-project-1\" logstore=\"test-logstore-1\" access-key-id=\"<yourAccessKeyId>\" access-key-secret=\"<yourAccessKeySecret>\"] $MSG\n"); template_escape(no); 
   }; 
   destination d_logservice{ 
        tcp("test-project-1.cn-hangzhou.log.aliyuncs.com" port(10009) 
        tls(peer-verify(required-untrusted)) 
        template(LogServiceFormat)); 
   }; 
   log { 
        source(s_sys); # default use s_sys 
        destination(d_logservice); 
   }; 
   ### END Syslog-ng Logging Config for LogService ###

3. Restart the syslog-ng utility.

   Run the sudo /etc/init.d/syslog-ng restart command, sudo service syslog-ng restart command, or sudo systemctl restart syslog-ng command to restart the syslog-ng utility.

4. Run the logger command to generate test logs.

   For example, you can run the logger hello world! command to generate logs.

Sample logs

After you upload logs to Simple Log Service, you must configure indexes for the logs. Then, you can view the logs in the Simple Log Service console. For more information, see Create indexes.

FAQ

• How do I simulate log uploading?

  You can use Netcat to simulate log uploading. This way, you can check whether the network connection is normal and whether the AccessKey pair is authorized to send syslog logs.

  1. Log on to the server on which you want to simulate log uploading.

  2. Run the following command to install Netcat:

     sudo yum install nmap-ncat

  3. Run the following command to connect to Simple Log Service:

     ncat --ssl <yourProject>.<yourEndpoint> 10009

     Example:

     ncat --ssl test-project-1.cn-hangzhou.log.aliyuncs.com 10009

  4. Netcat does not check whether network connections are interrupted. After you run a ncat command, enter the information that you want to send and press the Enter key in 30 seconds.

     <34>1 2019-03-28T03:00:15.003Z mymachine.example.com su - ID47 [logservice project="<yourProject>" logstore="<yourLogstore>" access-key-id="<yourAccessKeyID>" access-key-secret="<yourAccessKeySecret>"] this is a test message

     Example:

     <34>1 2019-03-28T03:00:15.003Z mymachine.example.com su - ID47 [logservice project="trace-doc-test" logstore="doc-test-001-logs" access-key-id="LTAI4***" access-key-secret="HfJEw***"] this is a test message

  5. After you send the syslog log, you can preview the log in the Simple Log Service console.

     For more information, see Preview logs.

     

• What do I do if logs fail to be uploaded?

  Troubleshoot the failure based on the error message. For more information, see How do I view Logtail collection errors?.