0

I intend to start up ~100 EC2 spot instances using Canonical's Ubuntu images. I am using multipart cloud-init user-data to setup packages, scripts, etc.

I would like to know how I can tell rsyslog to log to a splunk server (actually a splunk storm server) via the cloud-init configuration. Preferably, this would be done very early in the boot/config process so as to capture as much of the boot process logs themselves as possible.

Improve this question

1 Answer 1

Reset to default
2

Looks like there's a config provider for exactly this case; to throw a TCP syslog stream at splunk.example.com:

rsyslog:
 - '$RepeatedMsgReduction off'
 - filename: 30-splunk.conf
   content: '*.*   @@splunk.example.com'
Improve this answer
2
  • Right on the spot!
    – lynxman
    Aug 24, 2011 at 21:34
  • 1
    I was getting errors because of the wildcard in the multi-line content. Edited with quoting (and filename convention)
    – vsekhar
    Aug 24, 2011 at 21:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .