1

I'm having a problem using syslog drains as described in https://devcenter.heroku.com/articles/logging.

To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set up the security groups as they describe, and added a syslog drain using a command like heroku drains:add syslog://host1.example.com:514.

I can send messages from the Heroku console to my rsyslogd instance via nc. I see them appear in the log file, so I know there isn't a firewall/security group issue.  However, Heroku does not seem to be forwarding log messages to the server that heroku drains lists. I would expect to see HTTP requests, Rails messages, etc.

Is there something else I can try to do to figure this out? I'm new to rsyslogd, so I could easily be missing something.

Benjamin Oakes
  • 171
  • 10

3 Answers3

4

I found out what I had done wrong, with the help of Heroku Support. (Thanks guys!)

I had used the wrong security group name (default instead of logplex). (Dynos run under default, so that's why nc worked.)

These are the appropriate values for the fields in the AWS Security Group web interface:

  • Create a new rule: Custom TCP rule
  • Port range: 514
  • Source: 098166147350/logplex (NOTE: not default)
Benjamin Oakes
  • 171
  • 10
2

My two cents here:

Notice that adding the port number (514) at the end of the drain URL is important. I initially though that the 'syslog://' prefix should suffice, but apparently it doesn't.

Eli Polonsky
  • 121
  • 1
1

Thanks for posting this. One thing got me though. I had to restart my app on heroku before it started writing to the new drains. (after I tried so many other things!)

Tom Carchrae
  • 209
  • 2
  • 6
  • 1
    Happy it helped! :) For what it's worth, this may be more appropriate as a comment on my answer rather than a standalone answer itself. – Benjamin Oakes Sep 21 '12 at 14:43
  • well, it is another answer to the question. but hairs splitting. :) anyway, happy i got it working - also installed splunk which seems to be pretty fantastic to digest the logs. – Tom Carchrae Sep 21 '12 at 21:24
  • Oh, I thought you were saying that you had to do what my answer was, in addition to your own... My misunderstanding. :) – Benjamin Oakes Sep 21 '12 at 21:49