(if the optional mount is uncommented above). This will be used as a mount point for local storage of syslog events splunk_metadata.csv) the changesĬreate the subdirectory /opt/sc4s/archive. In the local/context directory, if you change the “non-example” version of a file (e.g. They will get overwritten at each SC4S start. These should not be used directly,īut copied as templates for your own log path development. To get you started, there is an example log path template ( )Īnd a filter ( nf) in the log_paths and filters subdirectories, respectively. That are not provided out of the box in SC4S. In the local/config/ directory there are four subdirectories that allow you to provide support for device types See the notes below for which files will be preserved on restarts. To read the local configurations properly. The files that are laid down change (or add) only individual files if desired. Of SC4S for local configurations and context overrides. The empty local directory created above will populate with defaults and examples at the first invocation This will be used as a mount point for local overrides and configurations.
See the “SC4S Disk Buffer Configuration” section on the Configruation page for more info.Ĭreate the subdirectory /opt/sc4s/local. var/lib/docker/volumes/ and could grow significantly if there is an extended outage to the SC4S destinations NOTE: Be sure to account for disk space requirements for the docker volume created above. Sudo docker volume create splunk - sc4s - var This will also be used to keep track of the state of syslog-ng between restarts, and in Execute the following command to create a local volume that will contain the disk buffer files in the event of a communicationįailure to the upstream destination(s).
DOCKER CE FOR MAC MOUNT /VAR/LIB/DOCKER? ARCHIVE
Description = SC4S Container Wants = rvice network-online.target rvice After = rvice network-online.target rvice Requires = rvice WantedBy = multi-user.target Environment = "SC4S_IMAGE=ghcr.io/splunk/splunk-connect-for-syslog/container:1" # Required mount point for syslog-ng persist data (including disk buffer) Environment = "SC4S_PERSIST_MOUNT=splunk-sc4s-var:/var/lib/syslog-ng" # Optional mount point for local overrides and configurations see notes in docs Environment = "SC4S_LOCAL_MOUNT=/opt/sc4s/local:/etc/syslog-ng/conf.d/local:z" # Optional mount point for local disk archive (EWMM output) files Environment = "SC4S_ARCHIVE_MOUNT=/opt/sc4s/archive:/var/lib/syslog-ng/archive:z" # Map location of TLS custom TLS Environment = "SC4S_TLS_MOUNT=/opt/sc4s/tls:/etc/syslog-ng/tls:z" TimeoutStartSec = 0 ExecStartPre = /usr/bin/docker pull $SC4S_IMAGE ExecStartPre = /usr/bin/bash -c "/usr/bin/systemctl set-environment SC4SHOST=$(hostname -s)" ExecStart = /usr/bin/docker run \ -e "SC4S_CONTAINER_HOST = $" \ -v "$SC4S_PERSIST_MOUNT" \ -v "$SC4S_LOCAL_MOUNT" \ -v "$SC4S_ARCHIVE_MOUNT" \ -v "$SC4S_TLS_MOUNT" \ -env-file = /opt/sc4s/env_file \ -network host \ -name SC4S \ -rm $SC4S_IMAGE Restart = on-abnormal SC4S Logging and Troubleshooting Resources
0 kommentar(er)
