Files
configpolicy/group_vars/victoria-logs.yml
Dustin C. Hatch b2d35ac881 victoria-logs: Listen for Linux netconsole logs
The Linux [netconsole][0] protocol is a very simple plain-text UDP
stream, with no real metadata to speak of.  Although it's not really
syslog, Victoria Logs is able to ingest the raw data into the `_msg`
field, and uses the time of arrival as the `_time` field.

_netconsole_ is somewhat useful for debugging machines that do not have
any other console (no monitor, no serial port), like the Raspberry Pi
CM4 modules in the DeskPi Super 6c cluster.  Unfortunately, its
implementation in the kernel is so simple, even the source address isn't
particularly useful as an identifier, and since Victoria Logs doesn't
track that anyway, we might as well just dump all the messages into a
single stream.

It's not really discussed in the Victora Logs documentation, but any
time multiple syslog listeners with different properties, _all_ of the
listeners _must_ specify _all_ of those properties.  The defaults will
_not_ be used for any stream; the value provided for one stream will be
used for all the others unless they specify one themselves.  Thus, in
order to use the default stream fields for the "regular" syslog
listener, we have to explicitly set them.

[0]: https://www.kernel.org/doc/html/latest/networking/netconsole.html
2025-07-27 17:47:31 -05:00

48 lines
1.5 KiB
YAML

data_volumes:
- dev: /dev/vdb
fstype: ext4
mountpoint: /var/lib/victoria-logs
victoria_logs_extra_args:
- '-syslog.listenAddr.tcp :601'
- '-syslog.listenAddr.udp :514'
- '-syslog.extraFields.udp ''{}'''
- '-syslog.streamFields.udp ''["hostname","app_name","proc_id"]'''
- '-syslog.listenAddr.udp :6666'
- '-syslog.extraFields.udp ''{"stream":"netconsole"}'''
- '-syslog.streamFields.udp ''["stream"]'''
victoria_logs_publish_ports:
- '514:514/udp'
- '601:601'
#- '6514:6514'
- '6666:6666/udp'
victoria_logs_firewall_ports:
- 514/udp
- 601/tcp
#- 6514/tcp
- 6666/udp
victoria_logs_caddy_server_name: logs.pyrocufflink.blue
victoria_logs_tls_client_auth: true
victoria_logs_tls_ca_cert: |+
-----BEGIN CERTIFICATE-----
MIIBlDCCAUagAwIBAgIUGNZ/ASP8F2ytev3YplTk4jA5a2EwBQYDK2VwMEgxCzAJ
BgNVBAYTAlVTMRgwFgYDVQQKDA9EdXN0aW4gQy4gSGF0Y2gxDTALBgNVBAsMBExv
a2kxEDAOBgNVBAMMB0xva2kgQ0EwHhcNMjQwMjIwMTUwMTQxWhcNMzQwMjIwMTUw
MTQxWjBIMQswCQYDVQQGEwJVUzEYMBYGA1UECgwPRHVzdGluIEMuIEhhdGNoMQ0w
CwYDVQQLDARMb2tpMRAwDgYDVQQDDAdMb2tpIENBMCowBQYDK2VwAyEAnmMawEIo
WfzFaLgpSiaPD+DHg28NHknMFcs7XpyTM9CjQjBAMB0GA1UdDgQWBBTFth3c4S/f
y0BphQy9SucnKN2pLzASBgNVHRMBAf8ECDAGAQH/AgEAMAsGA1UdDwQEAwIBBjAF
BgMrZXADQQCn0JWERsXdJA4kMM45ZXhVgAciwLNQ8ikoucsJcbWBp7bSMjcMVi51
I+slotQvQES/vfqp/zZFNl7KKyeeQ0sD
-----END CERTIFICATE-----
victoria_logs_caddy_forward_auth:
url: https://auth.pyrocufflink.blue
path: /api/verify
location: '?rd={scheme}://{host}{uri}'
victoria_logs_caddy_acme:
email: victoria_logs@pyrocufflink.blue
url: https://ca.pyrocufflink.blue/acme/acme/directory