1

I want to run multiple instances of rsyslogd (on different network namespaces [netns]). rsyslogd reads from /dev/log, and once a process reads, the socket is drained and another instance doesn't have anything to read! Is there any way to make one (say, master) instance of rsyslogd to replicate syslog messages to other local (slave) rsyslogd instances ? If this can be achieved in any other way, pointers/suggestions welcome. Since rsyslogd itself doesn't support Linux netns, looks like the only way to send out syslog messages on different namespaces - is to run multiple instances of rsyslogd.

2

You should be able to use any of several of rsyslog's output modules to do this. For example (stolen shamelessly and slightly modified from rsyslog.conf(5)) on your master:

*.*  :omrelp:192.168.0.2:2514
*.*  :omrelp:192.168.0.3:2514
*.*  :omrelp:192.168.0.4:2514

Would have the master send all syslog entries to the rsyslog running on those three IP addresses, which need to be configured like:

 $ModLoad imrelp
 $InputRELPServerRun 2514

(Note the *.* is a normal log selector, so you can limit the messages forwarded—e.g., local0.* :omrelp:192.168.0.4:2514 will forward only logs send to the local0 facility).

PS: What you're doing is a little weird. Normally people want to centralize logs. Depending on why you're doing this, you might actually want one of the other output modules (e.g., maybe you want to send your logs to a SQL database which programs in all the different namespaces can connect to and query).

PPS: There are other ways to handle this too—which sockets rsyslog reads and writes to are fully configurable. There is fairly extensive documentation on their web site, and of course probably in /usr/share/doc on your system as well.

  • Thank you. I will try the omrelp approach. Regarding what I am trying - I am not sure if this is the best approach, if there are other recommended best practices, please suggest/point me to the same. If we use a SQL DB, maybe I need to create a separate daemon to pull out the logs and send out on different namespaces ? My only intent is, the host should be able to send out syslogs on different network-namespaces (different networks, not reachable from the default namespace) – vyom Mar 31 '17 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.