topic Re: syslog-ng for sas rtdm log in SAS Customer Intelligence

syslog-ng for sas rtdm log

Loshadka — Thu, 20 Jun 2019 12:29:03 GMT

Hello everyone!

P.S Sorry for my English.

I need catch logs from Metadata server where level = INFO, using syslog-ng.

So, I have a question how should I configure syslog-ng.conf. In source I must indicate this:
source { file("/opt/sas/.../Metadata/metadataserver.sh"); }; and filter { level(info); }; or not?

I do not fully understand how metadata server send log in default directory and where I must catch it's.
And should I change file /opt/sas/.../Metadata/logconfig.xml ? Make a new configure?

Thanks

Re: syslog-ng for sas rtdm log

RajaMarla — Fri, 21 Jun 2019 17:25:00 GMT

I did not quite understand your question. But if you are interested in information about syslog-ng then you may want to look at the knowledgebase at https://support.oneidentity.com/syslog-ng-premium-edition/7.0.14

Moreover, I do not know which version of the product you are using. But perhaps the following information helps you:

Metadata server logs are written usually to a folder named:

<..../lev1/Web/WebAppServer/SASServer1_1/logs/ >

The log4j configurations are stored in a folder named:

<.../lev1/Web/Common/LogConfig>

Before attempting to make changes, ensure that you know how log4j works and its syntax. Extensive documentation is available via google.

Hope this helps.

Re: syslog-ng for sas rtdm log

Loshadka — Mon, 24 Jun 2019 07:33:48 GMT

Thank for you answer!

I think, my description a problem is not a correct.

I try one more time 🙂

Logs which I need writing, are located in /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs

But every day it make a new file for log, named like that - SASMeta_MetadataServer_%d_%S{hostname}_%S{pid}.log

My syslog-ng version - syslog-ng 2.0.9

I want configure /syslog-ng.conf file to reading log with level "info" from /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs

and send it on UDP - protocol to specified server. But I dont't now how I make it, 'cos every day log-file change his name.
I try configure syslog-ng.conf like this:

source sas_log { file("/opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs/SASMeta_MetadataServer_%d_%S{hostname}_%S{pid}.log"); };

but syslog don't understand this.

I wrote script-file:

#!/bin/bash

cd /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs/;
op=$(ls -t | head -1);
ech=$(echo $op);
tail -f -s 1 "$ech" | grep INFO ;

and specified it in source, but it doesn't working

Generally, I want what would syslog-ng every day read actual log-file, if it possible.

I hope I decrypt my idea right and simple 🙂

Re: syslog-ng for sas rtdm log

Loshadka — Mon, 24 Jun 2019 07:35:31 GMT

>>Logs which I need writing, are located in /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs

Sorry, I'm mean not writing, I mean reading.

Re: syslog-ng for sas rtdm log

RajaMarla — Mon, 24 Jun 2019 16:24:46 GMT

You can try the following, which will write the "active" log to a single fixed log file name:

- Backup/save the file /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/logconfig.xml as logconfig.xml.bak

- Edit the file /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/logconfig.xml (You will need to insert one line)

<appender class="RollingFileAppender" name="TimeBasedRollingFile">
<param name="File" value="/opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs/SAS_MetadataServer.log"/>
<param name="Append" value="false"/>

- Afterwards, stop/restart your services.

Now, you can use the log file: /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs/SAS_MetadataServer.log in your syslog-ng.conf

source sas_log { file("/opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs/SAS_MetadataServer.log"); };

Note

1. I do not know much about syslog-ng, so check the syntax carefully

2. I did not test the above...but I believe the above would work. You will need to test the above in a "test environment" before you change production configuration.

Re: syslog-ng for sas rtdm log

Loshadka — Tue, 25 Jun 2019 12:38:16 GMT

Thank you!

You decision is very good and simple.

I think, I try do that your say, if my decision not work.

😃

I do next thing's:

As I say I wrote simple script:

#!/bin/bash

while true;
do
cd /opt/sas94/SASConfig/Lev1/SASMeta/MetadataServer/Logs/;
op=$(ls -t | head -1);
ech=$(echo $op);
tail -f -s 1 "$ech" | grep -P 'INFO'>>/tmp/arcsight;
sleep 1;
done;

And started it in nohup.

Syslog source - source { file "/tmp/arcsight" .......); };

Now, syslog reading log from /tmp/arcsight and send it to specified server.

Thank you one more time!
P.S. sorry for my English