Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I intend to start up ~100 EC2 spot instances using Canonical's Ubuntu images. I am using multipart cloud-init user-data to setup packages, scripts, etc.

I would like to know how I can tell rsyslog to log to a splunk server (actually a splunk storm server) via the cloud-init configuration. Preferably, this would be done very early in the boot/config process so as to capture as much of the boot process logs themselves as possible.

share|improve this question
up vote 2 down vote accepted

Looks like there's a config provider for exactly this case; to throw a TCP syslog stream at

 - '$RepeatedMsgReduction off'
 - filename: 30-splunk.conf
   content: '*.*'
share|improve this answer
Right on the spot! – lynxman Aug 24 '11 at 21:34
I was getting errors because of the wildcard in the multi-line content. Edited with quoting (and filename convention) – vsekhar Aug 24 '11 at 21:54
@vsekhar Thanks! – Shane Madden Aug 24 '11 at 22:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.