Aggregate your syslog messages & filter for those that matter in real time.

How It Works

Tails acts as a syslog server, collecting messages via UDP. Messages are delivered to your browser using an HTML 5 WebSocket.

The browser is responsible for message filtering, separating them into defined “streams”.

You can create steams, each with their own filter terms.

Streams can be forwarded to loggly, a cloud based logging platform.

For example:

You could tail SSH logins with the term:

sshd

Or ignore LDAP messages with the term:

!slapd

Loggly forwarding requires a JSON enabled HTTP input. Each stream has a URL token unique to a Loggly input (Stream Settings).

Messages are non-persistent and they are automatically pruned.

Demo

Available here.

Install & Configure

Server

Install with Chef

For those who use OpsChef, a cookbook is available here.

Install Node.js & NPM

Please refer to Joyent’s fantastic documentation.

Install Tails

npm install tails -g

Run

Node.js process monitoring is outside the scope of this readme, you can run with nohup.

tails -h
usage: tails [options]
options:
  --syslog PORT   Default: 5140
  --http PORT     Default: 8080

nohup tails &

Clients

Append the following to your prefered syslog service configuration file.

Replace “tails.example.ca” with the hostname or IP address of your server running Tails.

Be sure to configure the correct port, Tails listens on 5140 by default.

Rsyslog

$template FwdTails,"<%PRI%>%TIMESTAMP% %HOSTNAME% %APP-NAME% %PROCID% %msg%"
$ActionForwardDefaultTemplate FwdTails
*.* @tails.example.ca:5140

Syslog-ng

destination tails { udp("tails.example.ca" port(5140)); };
log { source(s_all); destination(tails); };

Restart the service after making the change.

What’s Next

[ ] Clean up client side Javascript
[ ] Take a snapshot of a stream (persist)
[ ] Export a stream snapshot to JSON or CSV

CRUD

curl -id 'name=foo' localhost:8080/streams

curl -i localhost:8080/streams
  {"foo":{"name":"foo","terms":[],"forwarding":{"enabled":false,"token":""}}}

curl -id 'term=bar' localhost:8080/streams/foo/terms

curl -i localhost:8080/streams
  {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":false,"token":""}}}

curl -id 'token=loggly-input-token' localhost:8080/streams/foo/forwarding

curl -i localhost:8080/streams
  {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":true,"token":"loggly-input-token"}}}

curl -iX DELETE localhost:8080/streams/foo/terms/bar

curl -iX DELETE localhost:8080/streams/foo

Contributors

Sean Porter

Justin Kolberg

portertech/tails