ruby-on-rails - 使用rails elastic beanstalk配置rsyslog

Question

我使用 Elastic beanstalk 配置 Rails 应用程序的远程日志记录。我想从 /var/log/puma/puma.log 获取日志，但只获取一些内核和系统信息。这是我的配置 .ebextensions/papertrail.config

packages:
  yum:
    rsyslog: []
    rsyslog-gnutls: []
files:
  "/etc/rsyslog.d/01-udp.conf":
    mode: "000640"
    owner: root
    group: root
    content: |
      $ModLoad imudp
      $UDPServerRun 514
  "/etc/rsyslog.d/02-papertrail-tls.conf":
    mode: "000640"
    owner: root
    group: root
    content: |
      $DefaultNetstreamDriverCAFile /etc/papertrail-bundle.pem # trust these CAs
      $ActionSendStreamDriver gtls # use gtls netstream driver
      $ActionSendStreamDriverMode 1 # require TLS
      $ActionSendStreamDriverAuthMode x509/name # authenticate by hostname
      $ActionSendStreamDriverPermittedPeer *.papertrailapp.com
  "/etc/rsyslog.d/03-logfile-config.conf":
    mode: "000640"
    owner: root
    group: root
    content: |
      $ModLoad imfile
      $InputFileName /var/log/puma/puma.log
      $InputFileTag api
      $InputFileStateFile api-staging
      $InputFileSeverity error
      $InputFileFacility local3
      $InputRunFileMonitor
  "/etc/rsyslog.d/04-papertrail.conf":
    mode: "000640"
    owner: root
    group: root
    content: |
      $LocalHostName api-staging

container_commands:
  01_copy_ca_certs:
    command: 'cp ./.ebextensions/papertrail-bundle.pem /etc/papertrail-bundle.pem'
  02_install_rsyslog_config:
    command: '/bin/echo "*.* @${SYSLOG_HOST}" >> /etc/rsyslog.d/04-papertrail.conf'
  03_restart_rsyslog:
    command: 'sudo service rsyslog restart'

但我只在 papertrail 上获得一些信息，如下所示:

Nov 03 21:28:00 api-staging kernel:  imklog 5.8.10, log source = /proc/kmsg started.
Nov 03 21:28:00 api-staging rsyslogd:  [origin software="rsyslogd" swVersion="5.8.10" x-pid="32340" x-info="http://www.rsyslog.com"] start
Nov 03 23:50:41 api-staging kernel:  Kernel logging (proc) stopped.
Nov 03 23:50:41 api-staging rsyslogd:  [origin software="rsyslogd" swVersion="5.8.10" x-pid="32340" x-info="http://www.rsyslog.com"] exiting on signal 15.
Nov 04 00:51:56 api-staging kernel:  imklog 5.8.10, log source = /proc/kmsg started.
Nov 04 00:51:56 api-staging rsyslogd:  [origin software="rsyslogd" swVersion="5.8.10" x-pid="15883" x-info="http://www.rsyslog.com"] start
Nov 04 00:53:42 api-staging kernel:  Kernel logging (proc) stopped.

如果您有解决此问题的经验，请帮助我。谢谢!

Answer 1

您可能会遇到许多潜在问题，此处无法一一列举。由于在日志系统中包含文件访问，您的方法变得非常复杂。仅仅尝试抓取日志文件 (puma.log) 充其量是脆弱的，并且根据您的部署环境可能会导致许多可能的模糊故障。

我怀疑日志数据根本没有传递到日志守护进程，因此永远不会传递到 PaperTrail。

我建议您重新配置应用程序以通过 UDP 直接与日志守护程序通信，如下所述:

https://www.thoughtworks.com/mingle/infrastructure/2015/06/10/simple-solution-for-papertrail-on-elasticbeanstalk.html

一旦您进行了此更改，我怀疑您的问题就会得到解决。至少它会更容易排除故障，并且将来会更可靠。