.. _log_streaming:

Log Streaming
----------------------------

.. _21.1|VOSS-643|EKB-8744:

.. index:: log;log stream

VOSS Automate platform CLI commands are available to
enable and manage the streaming of a configurable list of
log files to a remote syslog server that can then for example
generate alarms based on log messages. The VOSS Assurance
product can for example be configured to be the remote server
that monitors the system.

The following parameters are available:

* Remote IP
* Remote port
* Protocol
* Files to stream


The **log stream** command parameters can therefore be used to:

* set up and remove remote log streaming on a server
* add and remove files to stream to a server

.. note::
 
   The **log stream** commands that make changes will restart the ``syslog`` service.

Refer to the command examples for parameter usage and CLI output.


.. rubric:: Command Examples


* **log stream remotelog**

  ::

    platform@VOSS:~$ log stream remotelog
    ip: Unset

* **log stream remotelog <IP:port>|off**

  ::

     platform@VOSS:~$ log stream remotelog 192.168.100.25:514
     You are about to restart syslog. Do you wish to continue? y
     System updated to use 192.168.100.25 as remote syslog server
     You have new mail in /var/mail/platform

* **log stream status**

  ::

     platform@VOSS:~$ log stream status
         stream: 
             ip: 192.168.100.25
             port: 514
             protocol: udp
     

* **log stream remotelog status**

  ::

    platform@VOSS:~$ log stream remotelog status
    ip: 192.168.100.25:514

   
* **log stream enable <filename>[,<filename>...]**

  ::

     platform@VOSS:~$ log stream enable syslog,auth.log
     You are about to restart syslog. Do you wish to continue? y
     syslog already in list of files to send to remote
     Updating list of files to stream to remote
     You have new mail in /var/mail/platform

     platform@VOSS:~$ log stream status
         stream: 
             filenames: 
                 syslog
                 auth.log
             ip: 192.168.100.25
             port: 514
             protocol: udp
     
     platform@VOSS:~$ log stream enable dmesg,dpkg.log
     You are about to restart syslog. Do you wish to continue? y
     Updating list of files to stream to remote
     platform@VOSS:~$ log stream status
         stream: 
             filenames: 
                 syslog
                 auth.log
                 dmesg
                 dpkg.log
             ip: 192.168.100.25
             port: 514
             protocol: udp

  If a file is already in the list, a message shows:
  "already in list of files to send to remote".

.. note::
   
   If the ``platform/event.log`` and ``platform/audit.log`` files are to be
   streamed, ensure that local logging has been enabled for these, using the 
   ``log event locallog on`` and ``log audit locallog on`` commands. 
   See: :ref:`log_type_commands`.


* **log stream disable <filename>**

  ::

     platform@VOSS:~$ log stream disable syslog
     You are about to restart syslog. Do you wish to continue? y
     syslog not currently in list of files to send to remote
     You have mail in /var/mail/platform

* **log stream protocol <tcp|udp>**: ``udp`` is default if not specified.


See also:

* :ref:`log_types`
* :ref:`log_type_commands`