How can you capture Linux systemd logs using the CloudWatch Agent?

1

I want to use the CloudWatch agent to capture events in systemd's Journal. I checked the CloudWatch agent docs but couldn't find anything relevant. I did find some old 3rd party projects on Github (journald-cloudwatch-logs, systemd-cloud-watch) that looked like they might work but I wanted to see if there was something native before I started down the path of "unknown" code.

A possible workaround might be to have journalcrl save service.unit to a log file and then ingest that with a normal "logs" CloudWatch agent config. But that seems pretty messy and would require some maintenance (rotate log files, etc.)

  • Did you see this gist? Is this relevant to what you are trying to do?

  • @dozenyommer - I did not see that gist, however it does look interesting. Thanx!

質問済み 2年前2597ビュー
1回答
0

One solution might be to use Datadog's Vector product to facilitate logging. Vector can use journald as a "source" and CloudWatch Logs and a "sink".

Another thought is to modify the systemd service file to save logging events to a physical file and then configure the CloudWatch agent to process that file. However, this requires us to manage a log file, and on a long running system that is tedious. I don't really want to worry about filling up the disk with old log information. And it seems much more efficient to just process journald directly.

However, I've never used Vector and can't be sure how it will work in practice. It may be that using a physical log file is easier and more reliable.

Wouldn't it be great if CloudWatch logs could talk to journald directly? Or even process a STDOUT stream? That way we could pipe information directly into CW without having to go through all this trouble.

回答済み 2年前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ