Skip to content
This repository was archived by the owner on Sep 2, 2025. It is now read-only.

Commit 43dea27

Browse files
aurbiztondo-splunkaurbiztondo-splunk
authored
Merge pull request #2315 from splunk/urbiz-OD6472-linux-docker
[6472]: Logs for Linux
2 parents 4d6888b + 6161863 commit 43dea27

File tree

4 files changed

+95
-84
lines changed

4 files changed

+95
-84
lines changed

‎gdi/opentelemetry/collector-kubernetes/kubernetes-config-logs.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
.. _kubernetes-config-logs:
33

44
*********************************************************************************
5-
Configure logs and events for Kubernetes
5+
Collect logs and events for the Collector for Kubernetes
66
*********************************************************************************
77

88
.. meta::

‎gdi/opentelemetry/collector-linux/collector-linux-intro.rst‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ Get started with the Collector for Linux
1717
linux-config-ootb.rst
1818
Default Linux metrics <metrics-ootb-linux.rst>
1919
linux-config.rst
20+
linux-config-logs.rst
2021
linux-upgrade.rst
2122
linux-uninstall.rst
2223
collector-configuration-tutorial/about-collector-config-tutorial.rst
@@ -30,8 +31,9 @@ To install and configure the Splunk Distribution of the OpenTelemetry Collector
3031
See the default settings and configuration options at:
3132

3233
* :ref:`linux-config-ootb`
33-
* :ref:`otel-linux-config`
3434
* By default, you'll obtain these :ref:`metrics <ootb-metrics-windows>`
35+
* :ref:`otel-linux-config`
36+
* :ref:`linux-config-logs`
3537

3638
.. include:: /_includes/gdi/collector-common-options.rst
3739

‎gdi/opentelemetry/collector-linux/install-linux.rst‎

Lines changed: 0 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -107,88 +107,6 @@ If you're installing your Collector instance in a host with Docker, you need to
107107
# or if specifying the user:group directly
108108
$ docker run -v /var/run/docker.sock:/var/run/docker.sock:ro --user "splunk-otel-collector:$(stat -c '%g' /var/run/docker.sock)" quay.io/signalfx/splunk-otel-collector:latest <...>
109109
110-
Collect logs for the Collector for Linux
111-
====================================================================
112-
113-
Use the Universal Forwarder to send logs to the Splunk platform. See more at :ref:`collector-with-the-uf`.
114-
115-
Fluentd is turned off by default. If you already installed Fluentd on a host, re-install the Collector without Fluentd using the ``--without-fluentd`` option.
116-
117-
.. _fluentd-manual-config-linux:
118-
119-
Collect Linux logs with Fluentd
120-
---------------------------------------
121-
122-
If you have a Log Observer entitlement or want to collect logs for the target host with Fluentd, use the ``--with-fluentd`` option to also install Fluentd when installing the Collector. For example:
123-
124-
.. code-block:: bash
125-
126-
curl -sSL https://dl.signalfx.com/splunk-otel-collector.sh > /tmp/splunk-otel-collector.sh && \
127-
sudo sh /tmp/splunk-otel-collector.sh --with-fluentd --realm $SPLUNK_REALM -- $SPLUNK_ACCESS_TOKEN
128-
129-
When turned on, the Fluentd service is configured by default to collect and forward log events with the ``@SPLUNK`` label to the Collector, which then sends these events to the HEC ingest endpoint determined by the ``--realm <SPLUNK_REALM>`` option. For example, ``https://ingest.<SPLUNK_REALM>.signalfx.com/v1/log``.
130-
131-
The following Fluentd plugins are also installed:
132-
133-
* ``capng_c`` for activating Linux capabilities.
134-
* ``fluent-plugin-systemd`` for systemd journal log collection.
135-
136-
Additionally, the following dependencies are installed as prerequisites for the Fluentd plugins:
137-
138-
.. tabs::
139-
140-
.. tab:: Debian-based systems
141-
142-
* build-essential
143-
* libcap-ng0
144-
* libcap-ng-dev
145-
* pkg-config
146-
147-
.. tab:: RPM-based systems
148-
149-
* Development Tools
150-
* libcap-ng
151-
* libcap-ng-devel
152-
* pkgconfig
153-
154-
You can specify the following parameters to configure the package to send log events to a custom Splunk HTTP Event Collector (HEC) endpoint URL:
155-
156-
* ``--hec-url <URL>``
157-
* ``--hec-token <TOKEN>``
158-
159-
HEC lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. See :new-page:`Set up and use HTTP Event Collector in Splunk Web <https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/UsetheHTTPEventCollector>`.
160-
161-
The main Fluentd configuration is installed to ``/etc/otel/collector/fluentd/fluent.conf``. Custom Fluentd source configuration files can be added to the ``/etc/otel/collector/fluentd/conf.d`` directory after installation.
162-
163-
Note the following:
164-
165-
* In this directory, all files with the .conf extension are automatically included by Fluentd.
166-
* The td-agent user must have permissions to access the configuration files and the paths defined within.
167-
* By default, Fluentd is configured to collect systemd journal log events from ``/var/log/journal``.
168-
169-
After any configuration modification, run ``sudo systemctl restart td-agent`` to restart the td-agent service.
170-
171-
If the td-agent package is upgraded after initial installation, you might need to set the Linux capabilities for the new version by performing the following steps for td-agent versions 4.1 or higher:
172-
173-
#. Check for the activated capabilities:
174-
175-
.. code-block:: bash
176-
177-
sudo /opt/td-agent/bin/fluent-cap-ctl --get -f /opt/td-agent/bin/ruby
178-
Capabilities in `` /opt/td-agent/bin/ruby`` ,
179-
Effective: dac_override, dac_read_search
180-
Inheritable: dac_override, dac_read_search
181-
Permitted: dac_override, dac_read_search
182-
183-
#. If the output from the previous command does not include ``dac_override`` and ``dac_read_search`` as shown above, run the following commands:
184-
185-
.. code-block:: bash
186-
187-
sudo td-agent-gem install capng_c
188-
sudo /opt/td-agent/bin/fluent-cap-ctl --add "dac_override,dac_read_search" -f /opt/td-agent/bin/ruby
189-
sudo systemctl daemon-reload
190-
sudo systemctl restart td-agent
191-
192110
.. _configure-auto-instrumentation:
193111

194112
Configure automatic discovery for back-end applications

‎gdi/opentelemetry/collector-linux/linux-config-logs.rst‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
.. _otel-install-linux-logs:
2+
.. _linux-config-logs:
3+
4+
***************************************************************
5+
Collect logs for the Collector for Linux
6+
***************************************************************
7+
8+
.. meta::
9+
10+
:description: Describes how to collect logs for the Splunk Distribution of OpenTelemetry Collector for Linux.
11+
12+
Use the Universal Forwarder to send logs to the Splunk platform. See more at :ref:`collector-with-the-uf`.
13+
14+
Fluentd is turned off by default. If you already installed Fluentd on a host, re-install the Collector without Fluentd using the ``--without-fluentd`` option.
15+
16+
.. _fluentd-manual-config-linux:
17+
18+
Collect Linux logs with Fluentd
19+
===========================================================================
20+
21+
If you have a Log Observer entitlement or want to collect logs for the target host with Fluentd, use the ``--with-fluentd`` option to also install Fluentd when installing the Collector. For example:
22+
23+
.. code-block:: bash
24+
25+
curl -sSL https://dl.signalfx.com/splunk-otel-collector.sh > /tmp/splunk-otel-collector.sh && \
26+
sudo sh /tmp/splunk-otel-collector.sh --with-fluentd --realm $SPLUNK_REALM -- $SPLUNK_ACCESS_TOKEN
27+
28+
When turned on, the Fluentd service is configured by default to collect and forward log events with the ``@SPLUNK`` label to the Collector, which then sends these events to the HEC ingest endpoint determined by the ``--realm <SPLUNK_REALM>`` option. For example, ``https://ingest.<SPLUNK_REALM>.signalfx.com/v1/log``.
29+
30+
The following Fluentd plugins are also installed:
31+
32+
* ``capng_c`` for activating Linux capabilities.
33+
* ``fluent-plugin-systemd`` for systemd journal log collection.
34+
35+
Additionally, the following dependencies are installed as prerequisites for the Fluentd plugins:
36+
37+
.. tabs::
38+
39+
.. tab:: Debian-based systems
40+
41+
* build-essential
42+
* libcap-ng0
43+
* libcap-ng-dev
44+
* pkg-config
45+
46+
.. tab:: RPM-based systems
47+
48+
* Development Tools
49+
* libcap-ng
50+
* libcap-ng-devel
51+
* pkgconfig
52+
53+
You can specify the following parameters to configure the package to send log events to a custom Splunk HTTP Event Collector (HEC) endpoint URL:
54+
55+
* ``--hec-url <URL>``
56+
* ``--hec-token <TOKEN>``
57+
58+
HEC lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. See :new-page:`Set up and use HTTP Event Collector in Splunk Web <https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/UsetheHTTPEventCollector>`.
59+
60+
The main Fluentd configuration is installed to ``/etc/otel/collector/fluentd/fluent.conf``. Custom Fluentd source configuration files can be added to the ``/etc/otel/collector/fluentd/conf.d`` directory after installation.
61+
62+
Note the following:
63+
64+
* In this directory, all files with the .conf extension are automatically included by Fluentd.
65+
* The td-agent user must have permissions to access the configuration files and the paths defined within.
66+
* By default, Fluentd is configured to collect systemd journal log events from ``/var/log/journal``.
67+
68+
After any configuration modification, run ``sudo systemctl restart td-agent`` to restart the td-agent service.
69+
70+
If the td-agent package is upgraded after initial installation, you might need to set the Linux capabilities for the new version by performing the following steps for td-agent versions 4.1 or higher:
71+
72+
#. Check for the activated capabilities:
73+
74+
.. code-block:: bash
75+
76+
sudo /opt/td-agent/bin/fluent-cap-ctl --get -f /opt/td-agent/bin/ruby
77+
Capabilities in `` /opt/td-agent/bin/ruby`` ,
78+
Effective: dac_override, dac_read_search
79+
Inheritable: dac_override, dac_read_search
80+
Permitted: dac_override, dac_read_search
81+
82+
#. If the output from the previous command does not include ``dac_override`` and ``dac_read_search`` as shown above, run the following commands:
83+
84+
.. code-block:: bash
85+
86+
sudo td-agent-gem install capng_c
87+
sudo /opt/td-agent/bin/fluent-cap-ctl --add "dac_override,dac_read_search" -f /opt/td-agent/bin/ruby
88+
sudo systemctl daemon-reload
89+
sudo systemctl restart td-agent
90+
91+

0 commit comments

Comments
 (0)