pipistrello
fb3ac50522
Confirmed via packet capture: a Yealink phone and (per RouterOS's known
default behavior) the fleet's routers send classic BSD-style syslog,
not RFC5424. Alloy's loki.source.syslog defaults to RFC5424-only and
was silently dropping every message ("expecting a version value in the
range 1-999"). syslog_format = "rfc3164" fixes it, but that argument
only exists from Alloy v1.5.0 onward (confirmed empirically against
v1.4.3, which fails config load) — bump the pin accordingly. v1.5.0 is
an adjacent minor release, not the kind of large version jump that hit
the Loki/Grafana :latest kernel-incompatibility bug fixed earlier.
73 lines
1.8 KiB
Plaintext
73 lines
1.8 KiB
Plaintext
// Receives syslog from routers, switches, and Yealink phones on this host's
|
|
// LAN interface, tags each message with useful labels, and ships it to the
|
|
// local Loki instance.
|
|
//
|
|
// Point network devices at this host's IP, port 514/udp (or 1514/tcp for
|
|
// devices that only speak TCP framing).
|
|
|
|
loki.relabel "syslog" {
|
|
forward_to = []
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_hostname"]
|
|
target_label = "hostname"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_severity"]
|
|
target_label = "severity"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_message_facility"]
|
|
target_label = "facility"
|
|
}
|
|
|
|
rule {
|
|
source_labels = ["__syslog_connection_ip_address"]
|
|
target_label = "source_ip"
|
|
}
|
|
}
|
|
|
|
// syslog_format is "rfc3164" (legacy BSD syslog, no version field) rather
|
|
// than the component's rfc5424 default — confirmed by packet capture that
|
|
// both the Yealink phones and RouterOS routers send rfc3164 in practice.
|
|
// A listener can only parse one format; if a device ever sends genuine
|
|
// rfc5424, it needs its own listener on a different port.
|
|
|
|
loki.source.syslog "network_devices_udp" {
|
|
listener {
|
|
address = "0.0.0.0:514"
|
|
protocol = "udp"
|
|
syslog_format = "rfc3164"
|
|
labels = {
|
|
job = "syslog",
|
|
transport = "udp",
|
|
}
|
|
}
|
|
|
|
relabel_rules = loki.relabel.syslog.rules
|
|
forward_to = [loki.write.default.receiver]
|
|
}
|
|
|
|
loki.source.syslog "network_devices_tcp" {
|
|
listener {
|
|
address = "0.0.0.0:1514"
|
|
protocol = "tcp"
|
|
syslog_format = "rfc3164"
|
|
labels = {
|
|
job = "syslog",
|
|
transport = "tcp",
|
|
}
|
|
}
|
|
|
|
relabel_rules = loki.relabel.syslog.rules
|
|
forward_to = [loki.write.default.receiver]
|
|
}
|
|
|
|
loki.write "default" {
|
|
endpoint {
|
|
url = "http://loki:3100/loki/api/v1/push"
|
|
}
|
|
}
|