From b2d35ac881fca2dc4ff49844a34144520cb5c62f Mon Sep 17 00:00:00 2001 From: "Dustin C. Hatch" Date: Sun, 27 Jul 2025 12:41:28 -0500 Subject: [PATCH] victoria-logs: Listen for Linux netconsole logs The Linux [netconsole][0] protocol is a very simple plain-text UDP stream, with no real metadata to speak of. Although it's not really syslog, Victoria Logs is able to ingest the raw data into the `_msg` field, and uses the time of arrival as the `_time` field. _netconsole_ is somewhat useful for debugging machines that do not have any other console (no monitor, no serial port), like the Raspberry Pi CM4 modules in the DeskPi Super 6c cluster. Unfortunately, its implementation in the kernel is so simple, even the source address isn't particularly useful as an identifier, and since Victoria Logs doesn't track that anyway, we might as well just dump all the messages into a single stream. It's not really discussed in the Victora Logs documentation, but any time multiple syslog listeners with different properties, _all_ of the listeners _must_ specify _all_ of those properties. The defaults will _not_ be used for any stream; the value provided for one stream will be used for all the others unless they specify one themselves. Thus, in order to use the default stream fields for the "regular" syslog listener, we have to explicitly set them. [0]: https://www.kernel.org/doc/html/latest/networking/netconsole.html --- group_vars/victoria-logs.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/group_vars/victoria-logs.yml b/group_vars/victoria-logs.yml index 02235bb..1bf0b20 100644 --- a/group_vars/victoria-logs.yml +++ b/group_vars/victoria-logs.yml @@ -6,16 +6,23 @@ data_volumes: victoria_logs_extra_args: - '-syslog.listenAddr.tcp :601' - '-syslog.listenAddr.udp :514' +- '-syslog.extraFields.udp ''{}''' +- '-syslog.streamFields.udp ''["hostname","app_name","proc_id"]''' +- '-syslog.listenAddr.udp :6666' +- '-syslog.extraFields.udp ''{"stream":"netconsole"}''' +- '-syslog.streamFields.udp ''["stream"]''' victoria_logs_publish_ports: - '514:514/udp' - '601:601' #- '6514:6514' +- '6666:6666/udp' victoria_logs_firewall_ports: - 514/udp - 601/tcp #- 6514/tcp +- 6666/udp victoria_logs_caddy_server_name: logs.pyrocufflink.blue victoria_logs_tls_client_auth: true