Linux Labs

Observability: metrics, alerts, logs / Stage 7 of 9

Logs in one place

Not running Starting usually ~20 s
Leave the lesson

Step 4 of 7 · on a machine · 7 min

TCP and UDP

The two forwarding signs are two protocols, and the collector only takes the ones turned on in its own settings.

It is handy to test the collector's reception apart from forwarding: logger can send a line to another server by itself, bypassing the machine's rsyslog. -n sets the server address, -P the port, -T sending over TCP, -d over UDP (in the Wiki). Always name the port: with -T but without -P logger looks for a separate TCP syslog port and on this machine exits with a "Servname not supported" error. logger puts the machine name and the line's tag in the same way rsyslog does.

Exercise · look

Send a line over TCP and over UDP

Send one test line to the collector with logger over TCP and one over UDP, see which files appeared in this machine's directory on the collector, and which inputs it has open on port 514.

First, predict

Both logger commands finished without errors. What will be in this machine's directory on the collector?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in

Over UDP the sender sends a line and does not wait for an answer: if nobody listens on the port, the line is lost, and neither logger nor rsyslog learns about it. TCP sets up a connection first: no listener — no connection, and the sender's rsyslog writes to its own log that forwarding is suspended and keeps retrying. By default the lines sent meanwhile are lost; rsyslog keeps them until the link is back only if forwarding is given a queue (queue.type). That is why servers forward over TCP, and UDP is left for devices that can do nothing else — switches, printers, old systems.

The collector takes lines only if its configuration loads a reception module and describes an input: imtcp for TCP, imudp for UDP (in the Wiki). Here is lab-collector's input from /etc/lab-collector/rsyslog.conf:

text
# TCP reception module and an input on 127.0.0.1:514
module(load="imtcp")
input(type="imtcp" address="127.0.0.1" port="514")

address limits reception to one of the machine's addresses: on 127.0.0.1 lines come only from the machine itself. A collector on a network needs the address of its network interface, and without address the input listens on all of them. ss shows whether an input works: a line with port 514 and the tcp or udp protocol.

Ubuntu 24.04
Loading…