Update passive_journal_centralization_guide_no_encryption.md
Costa Tsaousis committed
Oct 17, 2023 at 20:17 UTC
5c520e1a80a02872db39de30f3a537150f5137f9
1 file changed
+15
-12
collectors/systemd-journal.plugin/passive_journal_centralization_guide_no_encryption.md
+15
-12
@@ -2,24 +2,27 @@
2
3
This page will guide you through creating a passive journal centralization setup without the use of encryption.
4
5
-> A _passive_ journal server waits for clients to push their metrics to it.
5
+A _passive_ journal server waits for clients to push their metrics to it, so in this setup we will:
6
7
-> ⚠️ **IMPORTANT**
8
-> These instructions will copy your logs to a central server, without any encryption or authorization.
7
+1. configure `systemd-journal-remote` on the server, to listen for incoming connections.
8
+2. configure `systemd-journal-upload` on the clients, to push their logs to the server.
9
+
10
+> ⚠️ **IMPORTANT**<br/>
11
+> These instructions will copy your logs to a central server, without any encryption or authorization.<br/>
12
> DO NOT USE THIS ON NON-TRUSTED NETWORKS.
13
14
## Server configuration
15
16
On the centralization server install `systemd-journal-remote`:
17
15
-```sh
18
+```bash
19
# change this according to your distro
20
sudo apt-get install systemd-journal-remote
21
```
22
23
Make sure the journal transfer protocol is `http`:
24
22
-```sh
25
+```bash
26
sudo cp /lib/systemd/system/systemd-journal-remote.service /etc/systemd/system/
27
28
# edit it to make sure it says:
@@ -34,14 +37,14 @@ sudo systemctl daemon-reload
37
38
Optionally, if you want to change the port (the default is `19532`), edit `systemd-journal-remote.socket`
39
37
-```sh
40
+```bash
41
# edit the socket file
42
sudo systemctl edit systemd-journal-remote.socket
43
```
44
45
and add the following lines into the instructed place, and choose your desired port; save and exit.
46
44
-```sh
47
+```bash
48
[Socket]
49
ListenStream=<DESIRED_PORT>
50
```
@@ -58,9 +61,9 @@ sudo systemctl enable systemd-journal-remote.service
61
62
## Client configuration
63
61
-On the clients, install `systemd-journal-remote`:
64
+On the clients, install `systemd-journal-remote` (it includes `systemd-journal-upload`):
65
63
-```sh
66
+```bash
67
# change this according to your distro
68
sudo apt-get install systemd-journal-remote
69
```
@@ -74,7 +77,7 @@ URL=http://centralization.server.ip:19532
77
78
Edit `systemd-journal-upload`, and add `Restart=always` to make sure the client will keep trying to push logs, even if the server is temporarily not there, like this:
79
77
-```sh
80
+```bash
81
sudo systemctl edit systemd-journal-upload
82
```
83
@@ -87,7 +90,7 @@ Restart=always
90
91
Enable and start `systemd-journal-upload`, like this:
92
90
-```sh
93
+```bash
94
sudo systemctl enable systemd-journal-upload
95
sudo systemctl start systemd-journal-upload
96
```
@@ -96,7 +99,7 @@ sudo systemctl start systemd-journal-upload
99
100
To verify the central server is receiving logs, run this on the central server:
101
99
-```sh
102
+```bash
103
sudo ls -l /var/log/journal/remote/
104
```
105