Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I intend to start up ~100 EC2 spot instances using Canonical's Ubuntu images. I am using multipart cloud-init user-data to setup packages, scripts, etc.

I would like to know how I can tell rsyslog to log to a splunk server (actually a splunk storm server) via the cloud-init configuration. Preferably, this would be done very early in the boot/config process so as to capture as much of the boot process logs themselves as possible.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Looks like there's a config provider for exactly this case; to throw a TCP syslog stream at splunk.example.com:

rsyslog:
 - '$RepeatedMsgReduction off'
 - filename: 30-splunk.conf
   content: '*.*   @@splunk.example.com'
share|improve this answer
    
Right on the spot! –  lynxman Aug 24 '11 at 21:34
1  
I was getting errors because of the wildcard in the multi-line content. Edited with quoting (and filename convention) –  vsekhar Aug 24 '11 at 21:54
    
@vsekhar Thanks! –  Shane Madden Aug 24 '11 at 22:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.