OxDEAD Unicornz

Have you ever seen so many?

Some Notes Regarding Rsyslog and Remote Logging for Rails Apps

We use SyslogLogger gem in order to forward rails application log to system log.

in rails Gemfile:

1
2
3
group :production do
  gem "SyslogLogger", "~> 2.0", :require => 'syslog/logger'
end

in config/environments/production.rb

1
config.logger = Syslog::Logger.new "rails_application_name" 

The problem was that logs actually were forwarded to syslog, messages and user.log and sent to remote server and written to syslog, messages and user.log there. I was asked to make things DRY(ier).

The issue was caused, of cource, by some nasty *.* patterns in rsyslog config. If you’re experiencing similar issues, check /etc/rsyslog.d directory which contains rsyslog configuration files. Make sure you have separate config file for your application and it has higher load priority, for example:

1
2
3
4
# ls -l

-rw-r--r-- 1 root root   98 Jan  2 16:36 40-rails_application_name.conf
-rw-r--r-- 1 root root 1605 Dec 10  2010 50-default.conf

rules in 40-rails_application_name.conf will be checked first. Contents of 40-rails_application_name.conf file on rails application server:

1
2
if $programname == 'rails_application_name' then @@your.logging.server.ip.com:61514
& ~

Note “& ~”, it means log entry will be sent using TCP to your.logging.server.ip.com:61514 and won’t be processed further. This was missing and entries were forwarded to local log files. If you do need to log to the local file, don’t add “& ~”.

rules in 40-rails_application_name.conf file on log server:

1
2
3
4
5
$ModLoad imtcp
$InputTCPServerRun 61514

if $programname == 'rails_application_name' then /var/log/rails_application_name.log
& ~

Now logs are stored correctly.

Here is a complete guide for those who needs more details regarding rsyslog configuration.