Comments (7)
As I understand dmesg logs are copied to the journal, so some config like filters [{ "_TRANSPORT": "kernel" }]
should give you similar behaviour...
Clearly you must read from the head of the journal (rather than the tail) or the cursor will already have scrolled past the kernel logs...
from fluent-plugin-systemd.
This is my config for systemd (no filters ...):
<source>
@type systemd
@label @systemd
tag systemd.source
path /run/log/journal
pos_file /var/lib/fluentd/positiondb/systemd.source.pos
<entry>
field_map {"MESSAGE": "Payload", "_CMDLINE": "process", "_COMM": "programname", "_PID": "Pid", "_SYSTEMD_UNIT": "service", "priority": "Severity", "syslog_identifier": "ident" }
field_map_strict true
fields_strip_underscores true
fields_lowercase true
</entry>
</source>
When new messages lands in dmesg (ex. OOM), they are not collected.
from fluent-plugin-systemd.
And you are seeing the message with journalctl -k
?
from fluent-plugin-systemd.
Yep, correct. I disabled everything except source + final match and i see those events. Give me some time and i will debug what is wrong with my config...
from fluent-plugin-systemd.
Humm, I am not sure off hand...
Could you share a little more info about your setup, specifically OS / systemd versions...
Some thoughts that might help with debugging this:
- Try adding
filters [{ "_TRANSPORT": "kernel" }]
anyway, perhaps libsystemd has an implicit default to filter out these messages... - Is this a permissions issue? Try running fluentd as root to see if that makes any difference (just to debug)
- this plugin uses https://github.com/ledbettj/systemd-journal under the hood to read from the journal, if dmseg stuff really is copied to the journal it should be readable like any other entry...
- perhaps your systemd is not correctly copying the entries from the kernel ring buffer to the journal (I don't know how that happens... but I guess it must be a thing)
from fluent-plugin-systemd.
So yep, this is issue with my env. My config use rewrite_tag_filter based on service
field (which is created from _SYSTEMD_UNIT
.
<match systemd.source>
@type rewrite_tag_filter
<rule>
key service
pattern ^(.*)\.(.*)$
tag __TAG__.$1
</rule>
</match>
Normal messages have service fields:
2018-01-08T09:52:03+00:00 systemd.source.ssh {"Payload":"Accepted publickey for root from 172.16.10.90 port 50048 ssh2: RSA SHA256:DCSSfinZ+IFdLFh2SuvfdD3u5pcm8dG8zbVW8SQ1vyI","process":"sshd: root [priv] ","programname":"sshd","Pid":"7827","service":"ssh.service","Severity":"6","ident":"sshd","severity_label":"INFO", "Timestamp":"2018-01-08T09:52:03+0000"}
But kernel messages miss service fields:
2018-01-08T10:11:19+00:00 systemd.source.kernel {"Payload":"Out of memory: Kill process 10806 (a.out) score 650 or sacrifice child","Severity":"3","ident":"kernel","severity_label":"ERROR"}
So final result is that my kernel messages are dropped. Solution for that is to use also ident:
<match systemd.source>
@type rewrite_tag_filter
<rule>
key service
pattern ^(.*)\.(.*)$
tag __TAG__.$1
</rule>
<rule>
key ident
pattern ^(.*)$
tag __TAG__.$1
</rule>
</match>
We can close that issue, Thanks!
from fluent-plugin-systemd.
Yay, thanks for letting me know... I am glad that this does indeed work as I would expect
from fluent-plugin-systemd.
Related Issues (20)
- Error: Is a directory @ io_getpartial - /var/log/journal HOT 2
- Is it possible to transfer the ownership to fluent-plugins-nursery? HOT 7
- Does support Journal Namespaces? HOT 4
- Parser type filter not working with systemd logs
- Unable to read and output journal files from default path var/log/journal HOT 1
- No logs are read on systemd 253+ potentially HOT 2
- Can't configure storage with the conf.arg parameter HOT 1
- Segmentation fault on Ubuntu 22.04 HOT 4
- How to get Gke node reboot and shutdown logs using journald Systemd service unit HOT 1
- Do not install the plugin HOT 1
- Not able to ship logs even after adding td-agent user to systemd-journal group HOT 2
- heads up! - systemd 246 journal logs produced is not readable by older versions of systemd-journald HOT 2
- support for Fedora based systems? HOT 1
- Logs getting delayed
- This plugin does not seem to work when systemd rotates the journal
- Plugin crash during graceful shutdown
- Does this plugin support zstd compression compression?
- Latest 1.0.5 version is missing some gem dependencies
- Unable to read journal files from subdirectories under default path var/log/journal
- Using systemd entry in record_modifier
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fluent-plugin-systemd.