Score:0

TripleO: How to configure containerized rsyslog to use graylog instead of elasticsearch

in flag

Overview

Let me first give a short overview of what we want to accomplish. I am currently helping to deploy a TripleO Openstack Cloud, and we would like to use a different way of storing the logs provided by the rsyslog service that is created from the following heat template: rsyslog-container-puppet.yaml.

Instead of relying on elasticsearch to store the logs we would like to configure rsyslog to pass the logs to a graylog instance instead (using tls). This should be accomplished during the deployment process itself.

Current considerations

The first consideration was to override only specific parameters using the process outlined in this RedHat guide. Would it be possible to override configuration values of the rsyslog service using ExtraPreConfig?

The second consideration was to create a custom heat-template based on the original rsyslog template. If this would be the way to go, could you give some advice as to how to do it. I know you can provide custom templates using --templates argument when deploying the overcloud. But what I do not understand is if there are dependencies to the heat template and where I would start to implement the custom rsyslog template to store logs to graylog.

I hope you can help me find a solution to the problem at hand.

Best regards.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.