Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Unix environments

You can read more about using rsyslog to monitor and send files to a Devo endpoint in the Sending data to Devo section of our documentation. Here we offer a sample rsyslog configuration file that is set up to monitor the error, general query and slow query logs, and forward them to a Devo Relay. 

/etc/rsyslog.d/45-mysql.conf file
Code Block
$template mysql,"<%PRI%>%timegenerated% %HOSTNAME% %syslogtag% %msg%"
 
# MySQL error log
$InputFileName /var/log/mysql/error.log
$InputFileTag db.mysql.error.ENV.APP:CLON:
$InputFileStateFile stat-file1-MysqlError
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
# MySQL general log
input(
    type="imfile"
    File="/var/lib/mysql/mysql.log"
    Tag="db.mysql.out.production.devo-eam.rhel8:"
    Facility="user"
    Severity="info"
    PersistStateInterval="1"
    reopenOnTruncate="on"
    freshStartTail="on"

    ruleset="mysql-rules"
)

# MySQL generalerror log
$InputFileName 
input(
    type="imfile"
    File="/var/loglib/mysql/mysql-error.log"
 $InputFileTag   Tag="db.mysql.out.ENV.APP:CLON:
$InputFileStateFile stat-file1-MysqlOut
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
error.production.devo-eam.rhel8:"
    Facility="user"
    Severity="info"
    PersistStateInterval="1"
    reopenOnTruncate="on"
    freshStartTail="on"

    ruleset="mysql-rules"
)

# MySQL slow log
$InputFileName input(
    type="imfile"
    File="/var/loglib/mysql/mysql-slow.log"
$InputFileTag     Tag="db.mysql.slow.ENV.APP:CLON:
$InputFileStateFile stat-file1-MysqlSlow
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# SSL config for DEVO Cloud
#$DefaultNetstreamDriver gtls # use gtls netstream driver
#$DefaultNetstreamDriverCAFile /etc/rsyslog.d/certs/ca.crt
#$DefaultNetstreamDriverCertFile /etc/rsyslog.d/certs/user.crt
#$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/certs/user.key
#$ActionSendStreamDriverMode 1 # require TLS for the connection
#$ActionSendStreamDriverAuthMode x509/name
#$ActionSendStreamDriverPermittedPeer collector
 
if $syslogtag contains 'db.mysql.' and $syslogfacility-text == 'local7' then @@DEVO-RELAY:PORT;mysql
:syslogtag, contains, "db.mysql." ~production.devo-eam.rhel8:"
    Facility="user"
    Severity="info"
    PersistStateInterval="1"
    reopenOnTruncate="on"
    freshStartTail="on"

    ruleset="mysql-rules"
)

ruleset(name="mysql-rules") {
    action(
        type="omfwd"
        template="devo"
        queue.type="LinkedList"
        queue.filename="mysqlq1"
        queue.saveonshutdown="on"
        action.resumeRetryCount="-1"
        Target="127.0.0.1"
        Port="5140"
        Protocol="tcp"
    )
}

# Send to Devo directly over TLS
#ruleset(name="mysql-rules") {
#    action(
#        type="omfwd"
#        template="devo"
#        queue.type="LinkedList"
#        queue.filename="mysqlq1"
#        queue.saveonshutdown="on"
#        action.resumeRetryCount="-1"
#        Target="collector-us.devo.io"
#        Port="443"
#        Protocol="tcp"
#        StreamDriver="gtls"
#        StreamDriverMode="1"
#        StreamDriverAuthMode="x509/name"
#        StreamDriverPermittedPeers="collector-us.devo.io"
#    )
#}

Note the following placeholder values in the sample file above:

...