On 16-10-15 09:17, Erik Weber wrote: > I'm working a case where it would be required to ship logs from system vms > (in particular VRs). > > I can fix that by modifying rsyslog.conf inside systemvm.iso, but that > means I have to remember it every time we update, which is most likely to > be forgotten at some point in time. > > This it to discuss if it would make sense to allow a syslog destination to > be configurable at some level (by zone, cluster or system?) >
Yes, a remote loghost is a good idea. We might also want to configure log4j to do such things. In our case we are using Logstash with the Log4j input [0] on our KVM Agents, but this would also be handy on the SSVMs. Wido [0]: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html
