convox / syslog

Send CloudWatch Logs Securely to Syslog via a Lambda function

Convox

Convox is an open-source PaaS based on Kubernetes available for multiple cloud providers.

Supported Clouds

• Amazon Web Services
• Digital Ocean
• Google Cloud
• Microsoft Azure

Getting Started

• Introduction

Installation

• Command Line Interface
• Development Rack
• Production Rack

Features

• Release Management
• Secrets Management
• Load Balancing (automatic SSL)
• Service Discovery
• Resource Management (Postgres, Redis, etc)
• Automated Rollbacks
• Autoscaling
• Scheduled Runs (cron)
• One-off Commands

Resources

• Homepage
• Stack Overflow

Development Tips

When testing new changes, a good way of adding them to a test rack is to build the image locally,push to a public repo and update the k8s deployment api:

docker build -t user/convox:tag .
docker push user/convox:tag
kubectl set image deploy api system=user/convox:tag -n rackName-system

If testing new changes in terraform, install the rack using the following command to have the /terraform folder mapped to the rack tf manifest.

/convox: CONVOX_TERRAFORM_SOURCE=$PWD//terraform/system/%s convox rack install aws rack1

After saving your changes, go to (Linux:~/.config/convox/racks/rack1 or OSX:/System/Volumes/Data/Users/$PROFILENAME/Library/Preferences/convox/racks and run terraform apply

License

• Apache 2.0

syslog's Issues

[GEN2] Syslog does not successfully link to gen2 apps

I do convox resources link syslog-asdasd --app appname
then see it move to updating
then to rollback
and I never get the logs forwarded.

Not sure if it is simply not supported or if it is an error.

Syslog service creation fails in ap-southeast-1

I am seeing this failure message when trying to create a syslog service on a rack running in ap-southeast-1:

$ convox rack
Name     singapore
Status   running
Version  20160905130000
Region   ap-southeast-1
Count    3
Type     t2.small

$ time convox services create syslog --url tcp+tls://logs4.papertrailapp.com:12345
Creating syslog-2298 (syslog: url="tcp+tls://logs4.papertrailapp.com:12345")... CREATING

$ convox services
NAME           TYPE     STATUS
syslog-2298    syslog   failed
convox-events  webhook  running
s3-assets      s3       running

$ convox services info syslog-2298
Name    syslog-2298
Status  failed
Reason  Your access has been denied by S3, please make sure your request credentials have permission to GetObject for convox-ap-southeast-1/lambda/syslog.zip. S3 Error Code: AccessDenied. S3 Error Message: Access Denied
Exports
  URL: tcp+tls://logs4.papertrailapp.com:12345

The same commands work correctly on racks in us-east-1 and us-west-2.

Invalid program name when using Syslog forwarder, sending logs to Papertrail

Hi there,

We use a Syslog forwarder and forward our logs to Papertrail, as in Convox's example.

On the 15th of November, our logs started showing the following as "program name":
convox/syslog/unknown
instead of what they used to show before, the name of the Convox service, release and container identifier:
maestro-mock:RSITDWPHPKY/1c018b9c4e0a
This was following a Rack update that was manually triggered.

I talked to Papertrail, and they had the following to say:

The key bit of that code for identifying the program is in Lines 75 to 119, and the default value is convox/syslog/unknown. This is almost certainly something Convox is doing, or not doing - somehow, it's no longer picking up the app/release/container ID info. (Papertrail generally doesn't do much parsing on incoming messages, aside from trying to make sure they match a syslog format. If that was failing, I'd expect the whole line to come through in the message with an IP and basic program name added on, rather than a properly formatted message with a specific program name.)

The Convox syslog code itself hasn't changed much recently - most of it is from more than six months ago - so one thing that came to mind is whether the NativeLogging option mentioned in the comments is now being used.

If it's not that, though, it might be more useful to try to explore this with Convox Support. Depending on what method of support is appropriate, feel free to loop us in if it's feasible, by cc'ing [email protected].

Does that make sense? I'd like to be able to provide more concrete guidance, but it's hard for me to guess what might have caused the change without a better knowledge of the whole system, which I imagine Convox would have. (Though one thing that did come to mind is whether the errors on Lines 93 and 112 are showing up anywhere.)

Do you support sumologic?

Do you support a sumologic syslog endpoint?

Thanks