Documentation forLoggly

Puppet Logs and Deployment

The scripts are not supported under any SolarWinds support program or service. The scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.

Use Puppet to setup Loggly on hundreds of nodes, monitor deployments and agents in real time, and keep your logs secure with TLS. The loggly puppet module supports the rsyslog and syslog-ng daemons, as well as both Redhat and Debian families of Linux. It defaults to sending syslog over TCP with TLS encryption turned on, and stores the certificate in /usr/local/loggly/certs. We followed the Puppet installation guide to set it up. This was tested with Ubuntu 12.04.3-LTS, Puppet 2.7.11, and the default log configuration and directories. For alternatives, please see the Advanced Options section.

Puppet Logs and Deployment Setup

1. Install the Loggly Puppet Module

On your puppet master, install the loggly puppet module from PuppetForge. Alternatively, you can install it from GitHub.

cd /etc/puppet/modules
sudo puppet module install loggly/loggly 

2. Configure Puppet

Open your puppet site manifest file, or your own manifest that you’ve included.

sudo vim /etc/puppet/manifests/site.pp 

Paste in configuration for the loggly rsyslog class. Replace the TOKEN with your customer token.

# Send syslog events to Loggly
class { 'loggly::rsyslog':
  customer_token => 'TOKEN',
} 

3. Trigger Puppet Agents

Trigger the puppet agents to run their configurations by restarting or kicking them, or wait the default 30 minutes for them to do it.

4. Verify Events

The default log destination for puppet agents is syslog, so rsyslog will send them to Loggly. Search Loggly for events from the puppet agent over the past hour. It may take a few minutes to index the event. If it doesn’t work, see the troubleshooting section below.

syslog.appName:"puppet-agent" 

Puppet Logs Example

Advanced Puppet Logging and Deployment Options

  • Loggly Puppet Module Docs – Describes how to use it with syslog-ng, turn off TLS, or install from GitHub
  • File Monitoring – You can also configure your syslog daemon to monitor files
  • Search or post your own Puppet logs or Puppet deployment questions in the community forum.

Troubleshooting Puppet Deployment and Logs

If you don’t see any data show up in the verification step, then check for these common problems.

Check Puppet:

  • Wait a few minutes in case indexing needs to catch up
  • Check to make sure you inserted your own customer token
  • Make sure the puppet agents processed the new configuration. This can take 30 minutes if you don’t trigger them.
  • Check if the log destination for puppet agents is the default of syslog. If not, try a test event by running logger test.
  • Check for error messages from the puppet agent in /var/log/syslog

Check Your Syslog Daemon:

Still Not Working?

  • Search or post your own Puppet master logs, Puppet agent, or even Puppet Labs questions in the community forum.