Getting Data In

How to monitor Fedora OS logs using journald (binary file) in Splunk?

cab007
Engager

HI,

I want to monitor fedora Server's (Version 21) logs into Splunk Enterprise. I already tried to monitor logs from path /var/log/journal which are in binary form and also made changes in props.conf, inputs.conf, and outputs.conf as follows:

props.conf

[syslog]
NO_BINARY_CHECK = true

inputs.conf

[monitor:///var/log/journal]
sourcetype = syslog

outputs.conf

[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = Host:port
[tcpout-server://host:port]

But I am getting junk values raw event.
There are couple of workarounds like using journalctl and rsyslog we can redirect logs in text like formats and monitor them.
But my requirement is to monitor the jounald binary itself as monitoring binary is supported in Splunk.

Any suggestions how can I monitor the binary in Splunk?

Thanks,
Chandni

JSkier
Communicator

Take a look at these:
https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-system...
https://www.splunk.com/blog/2015/04/30/integrating-splunk-with-docker-coreos-and-journald.html

The latter will do what you want, works great (just omit the Docker lines for the systemd unit). You basically write the journal to a json file. Splunk loves json and it will map the fields perfectly. If you don't restart the service much, make sure you rotate or clean the file periodically, or it will continue to grow.

0 Karma

hettervik
Builder

Hi Chandni! Did you ever find a good way to monitor the journal files with Splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...