Syslog and Google Cloud Monitoring Integration

Powerful performance with an easy integration, powered by Telegraf, the open source data connector built by InfluxData.

info

This is not the recommended configuration for real-time query at scale. For query and compression optimization, high-speed ingest, and high availability, you may want to consider Syslog and InfluxDB.

5B+

Telegraf downloads

#1

Time series database
Source: DB Engines

1B+

Downloads of InfluxDB

2,800+

Contributors

Table of Contents

Powerful Performance, Limitless Scale

Collect, organize, and act on massive volumes of high-velocity data. Any data is more valuable when you think of it as time series data. with InfluxDB, the #1 time series platform built to scale with Telegraf.

See Ways to Get Started

Input and output integration overview

The Syslog plugin enables the collection of syslog messages from various sources using standard networking protocols. This functionality is critical for environments where systems need to be monitored and logged efficiently.

The Stackdriver plugin allows users to send metrics directly to a specified project in Google Cloud Monitoring, facilitating robust monitoring capabilities across their cloud resources.

Integration details

Syslog

The Syslog plugin for Telegraf captures syslog messages transmitted over various protocols such as TCP, UDP, and TLS. It supports both RFC 5424 (the newer syslog protocol) and the older RFC 3164 (BSD syslog protocol). This plugin operates as a service input, effectively starting a service that listens for incoming syslog messages. Unlike traditional plugins, service inputs may not function with standard interval settings or CLI options like --once. It includes options for setting network configurations, socket permissions, message handling, and connection handling. Furthermore, the integration with Rsyslog allows forwarding of logging messages, making it a powerful tool for collecting and relaying system logs in real-time, thus seamlessly integrating into monitoring and logging systems.

Google Cloud Monitoring

This plugin writes metrics to a project in Google Cloud Monitoring, which used to be known as Stackdriver. Authentication is a prerequisite and can be achieved via service accounts or user credentials. The plugin is designed to group metrics by a namespace variable and metric key, facilitating organized data management. However, users are encouraged to use the official naming format for enhanced query efficiency. The plugin supports additional configurations for managing metric representation and allows tags to be treated as resource labels. Notably, it imposes certain restrictions on the data it can accept, such as not allowing string values or points that are out of chronological order.

Configuration

Syslog

[[inputs.syslog]]
  ## Protocol, address and port to host the syslog receiver.
  ## If no host is specified, then localhost is used.
  ## If no port is specified, 6514 is used (RFC5425#section-4.1).
  ##   ex: server = "tcp://localhost:6514"
  ##       server = "udp://:6514"
  ##       server = "unix:///var/run/telegraf-syslog.sock"
  ## When using tcp, consider using 'tcp4' or 'tcp6' to force the usage of IPv4
  ## or IPV6 respectively. There are cases, where when not specified, a system
  ## may force an IPv4 mapped IPv6 address.
  server = "tcp://127.0.0.1:6514"

  ## Permission for unix sockets (only available on unix sockets)
  ## This setting may not be respected by some platforms. To safely restrict
  ## permissions it is recommended to place the socket into a previously
  ## created directory with the desired permissions.
  ##   ex: socket_mode = "777"
  # socket_mode = ""

  ## Maximum number of concurrent connections (only available on stream sockets like TCP)
  ## Zero means unlimited.
  # max_connections = 0

  ## Read timeout (only available on stream sockets like TCP)
  ## Zero means unlimited.
  # read_timeout = "0s"

  ## Optional TLS configuration (only available on stream sockets like TCP)
  # tls_cert = "/etc/telegraf/cert.pem"
  # tls_key  = "/etc/telegraf/key.pem"
  ## Enables client authentication if set.
  # tls_allowed_cacerts = ["/etc/telegraf/clientca.pem"]

  ## Maximum socket buffer size (in bytes when no unit specified)
  ## For stream sockets, once the buffer fills up, the sender will start
  ## backing up. For datagram sockets, once the buffer fills up, metrics will
  ## start dropping. Defaults to the OS default.
  # read_buffer_size = "64KiB"

  ## Period between keep alive probes (only applies to TCP sockets)
  ## Zero disables keep alive probes. Defaults to the OS configuration.
  # keep_alive_period = "5m"

  ## Content encoding for message payloads
  ## Can be set to "gzip" for compressed payloads or "identity" for no encoding.
  # content_encoding = "identity"

  ## Maximum size of decoded packet (in bytes when no unit specified)
  # max_decompression_size = "500MB"

  ## Framing technique used for messages transport
  ## Available settings are:
  ##   octet-counting  -- see RFC5425#section-4.3.1 and RFC6587#section-3.4.1
  ##   non-transparent -- see RFC6587#section-3.4.2
  # framing = "octet-counting"

  ## The trailer to be expected in case of non-transparent framing (default = "LF").
  ## Must be one of "LF", or "NUL".
  # trailer = "LF"

  ## Whether to parse in best effort mode or not (default = false).
  ## By default best effort parsing is off.
  # best_effort = false

  ## The RFC standard to use for message parsing
  ## By default RFC5424 is used. RFC3164 only supports UDP transport (no streaming support)
  ## Must be one of "RFC5424", or "RFC3164".
  # syslog_standard = "RFC5424"

  ## Character to prepend to SD-PARAMs (default = "_").
  ## A syslog message can contain multiple parameters and multiple identifiers within structured data section.
  ## Eg., [id1 name1="val1" name2="val2"][id2 name1="val1" nameA="valA"]
  ## For each combination a field is created.
  ## Its name is created concatenating identifier, sdparam_separator, and parameter name.
  # sdparam_separator = "_"

Google Cloud Monitoring

[[outputs.stackdriver]]
  ## GCP Project
  project = "project-id"

  ## Quota Project
  ## Specifies the Google Cloud project that should be billed for metric ingestion.
  ## If omitted, the quota is charged to the service account’s default project.
  ## This is useful when sending metrics to multiple projects using a single service account.
  ## The caller must have the `serviceusage.services.use` permission on the specified project.
  # quota_project = ""

  ## The namespace for the metric descriptor
  ## This is optional and users are encouraged to set the namespace as a
  ## resource label instead. If omitted it is not included in the metric name.
  namespace = "telegraf"

  ## Metric Type Prefix
  ## The DNS name used with the metric type as a prefix.
  # metric_type_prefix = "custom.googleapis.com"

  ## Metric Name Format
  ## Specifies the layout of the metric name, choose from:
  ##  * path: 'metric_type_prefix_namespace_name_key'
  ##  * official: 'metric_type_prefix/namespace_name_key/kind'
  # metric_name_format = "path"

  ## Metric Data Type
  ## By default, telegraf will use whatever type the metric comes in as.
  ## However, for some use cases, forcing int64, may be preferred for values:
  ##   * source: use whatever was passed in
  ##   * double: preferred datatype to allow queries by PromQL.
  # metric_data_type = "source"

  ## Tags as resource labels
  ## Tags defined in this option, when they exist, are added as a resource
  ## label and not included as a metric label. The values from tags override
  ## the values defined under the resource_labels config options.
  # tags_as_resource_label = []

  ## Custom resource type
  # resource_type = "generic_node"

  ## Override metric type by metric name
  ## Metric names matching the values here, globbing supported, will have the
  ## metric type set to the corresponding type.
  # metric_counter = []
  # metric_gauge = []
  # metric_histogram = []

  ## NOTE: Due to the way TOML is parsed, tables must be at the END of the
  ## plugin definition, otherwise additional config options are read as part of
  ## the table

  ## Additional resource labels
  # [outputs.stackdriver.resource_labels]
  #   node_id = "$HOSTNAME"
  #   namespace = "myapp"
  #   location = "eu-north0"

Input and output integration examples

Syslog

  1. Centralized Log Management: Use the Syslog plugin to aggregate log messages from multiple servers into a central logging system. This setup can help in monitoring overall system health, troubleshooting issues effectively, and maintaining audit trails by collecting syslog data from different sources.

  2. Real-Time Alerting: Integrate the Syslog plugin with alerting tools to trigger real-time notifications when specific log patterns or errors are detected. For example, if a critical system error appears in the logs, an alert can be sent to the operations team, minimizing downtime and performing proactive maintenance.

  3. Security Monitoring: Leverage the Syslog plugin for security monitoring by capturing logs from firewalls, intrusion detection systems, and other security devices. This logging capability enhances security visibility and helps in investigating potentially malicious activities by analyzing the captured syslog data.

  4. Application Performance Tracking: Utilize the Syslog plugin to monitor application performance by collecting logs from various applications. This integration helps in analyzing the application’s behavior and performance trends, thus aiding in optimizing application processes and ensuring smoother operation.

Google Cloud Monitoring

  1. Multi-Project Metric Aggregation: Use this plugin to send aggregated metrics from various applications across different projects into a single Google Cloud Monitoring project. This use case helps centralize metrics for teams managing multiple applications, providing a unified view for performance monitoring and enhancing decision-making. By configuring different quota projects for billing, organizations can ensure proper cost management while benefiting from a consolidated monitoring strategy.

  2. Anomaly Detection Setup: Integrate the plugin with a machine learning-based analytics tool that identifies anomalies in the collected metrics. Using the historical data provided by the plugin, the tool can learn normal baseline behavior and promptly alert the operations team when unusual patterns arise, enabling proactive troubleshooting and minimizing service disruptions.

  3. Dynamic Resource Labeling: Implement dynamic tagging by utilizing the tags_as_resource_label option to adaptively attach resource labels based on runtime conditions. This setup allows metrics to provide context-sensitive information, such as varying environmental parameters or operational states, enhancing the granularity of monitoring and reporting without changing the fundamental metric structure.

  4. Custom Metric Visualization Dashboards: Leverage the data collected by the Google Cloud Monitoring output plugin to feed a custom metrics visualization dashboard using a third-party framework. By visualizing metrics in real-time, teams can achieve better situational awareness, notably by correlating different metrics, improving operational decision-making, and streamlining performance management workflows.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.

Powerful Performance, Limitless Scale

Collect, organize, and act on massive volumes of high-velocity data. Any data is more valuable when you think of it as time series data. with InfluxDB, the #1 time series platform built to scale with Telegraf.

See Ways to Get Started

Related Integrations

HTTP and InfluxDB Integration

The HTTP plugin collects metrics from one or more HTTP(S) endpoints. It supports various authentication methods and configuration options for data formats.

View Integration

Kafka and InfluxDB Integration

This plugin reads messages from Kafka and allows the creation of metrics based on those messages. It supports various configurations including different Kafka settings and message processing options.

View Integration

Kinesis and InfluxDB Integration

The Kinesis plugin allows for reading metrics from AWS Kinesis streams. It supports multiple input data formats and offers checkpointing features with DynamoDB for reliable message processing.

View Integration