tommaso-ascani commented 4 months ago

Implementation of new ui components to manage logs forwarders.

There will be two available kind of services:

Forward to remote syslog server
Forward to Cloud Log Manager

New elements:

System logs card on Cluster Status where is also visible the forwarders status.
Two menu items on Loki instance card on Settings -> System logs.
Two modals, one for each forwarders, that can be opened from the menù of loki instance and where forwarders can be set.

DavidePrincipi commented 3 months ago

In testing:

loki ~1.2.0-dev.1~ 1.2.0-dev.2
core ~2.9.0-dev.1~

tommaso-ascani commented 2 months ago

Test Case

Requirements:

Ns8 cluster installed
Loki instance running on leader node
An active subscription
Cloud Log Manager account and tenant
Server syslog

Cloud Log Manager

Step to set forwarders

Go to Settings -> System logs
Click on three dots menù and click on Configure Cloud Log Manager
Insert address (it is pre-compiled), tenant and start logging time
Click Configure

To check

Reloading page you can check if forwarder is active and not failed or more specifically you can ssh into you machine as root and check it manually:
```
runagent -m $(redis-cli --raw get cluster/default_instance/loki)
systemctl --user status cloud-log-manager-forwarder
```

Accessing to your machine as root, run this to get Cloud Log Manager host identifier:

redis-cli hget module/$(redis-cli --raw get cluster/default_instance/loki)/environment CLOUD_LOG_MANAGER_HOSTNAME

Opening Cloud Log Manager admin panel check if your host identifier is present and is receiving logs (sometimes can take a some minutes if there is a big amount of logs)

Syslog

Example of syslog server

It is possible to start a syslog server insde a docker/podman container for testing purpose, here an example of docker-compose.yml:

services:
  syslog:
    image: balabit/syslog-ng:latest
    container_name: syslog
    ports:
      - 514:514/udp
      - 601:601/tcp
    volumes:
      - $PWD/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf
    restart: always

syslog-ng.conf:

@version: 4.6

source s_external {
        network(ip("0.0.0.0") port(601) transport(tcp) flags(no-parse,store-raw-message));
        network(ip("0.0.0.0") port(514) transport(udp) flags(no-parse,store-raw-message));
};

template forward_template {
        template("$RAWMSG\n");
};

destination d_external {
        file("/var/log/messages" template(forward_template));
};

log {
        source(s_external);
        destination(d_external);
};

WARNING: Forwarder correct working could depend on syslog server configuration, so if you are not able to let it work properly, check your configuration.

Step to set forwarders:

Go to Settings -> System logs
Click on three dots menù and click on Configure export to Syslog
Insert you syslog server address (if it's a container inspect network to find ip address), port and select others configuration
Click Configure

To check

Reloading page you can check if forwarder is active and not failed or more specifically you can ssh into you machine as root and check it manually:
```
runagent -m $(redis-cli --raw get cluster/default_instance/loki)
systemctl --user status syslog-forwarder
```
Control in your server syslog is receiving logs and if they are correct, if your syslog server is inside a container as the example above you can run the following command to check:
```
docker exec -it syslog bash
tail -f /var/log/messages
```