I intend to start up ~100 EC2 spot instances using Canonical's Ubuntu images. I am using multipart cloud-init user-data to setup packages, scripts, etc.

I would like to know how I can tell rsyslog to log to a splunk server (actually a splunk storm server) via the cloud-init configuration. Preferably, this would be done very early in the boot/config process so as to capture as much of the boot process logs themselves as possible.


Looks like there's a config provider for exactly this case; to throw a TCP syslog stream at splunk.example.com:

 - '$RepeatedMsgReduction off'
 - filename: 30-splunk.conf
   content: '*.*   @@splunk.example.com'
  • Right on the spot! – lynxman Aug 24 '11 at 21:34
  • 1
    I was getting errors because of the wildcard in the multi-line content. Edited with quoting (and filename convention) – vsekhar Aug 24 '11 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.