I have no experience with syslog-ng, but I can share my experience with another option, elasticsearch. There is no need to use logstash anymore, fielbeat can deal with it, and it's much easier to configure.
On the logserver.
You can add this to the filebeat.yml
```
filebeat.inputs:
- type: syslog
format: auto
protocol.tcp:
host: "0.0.0.0:2514"
- type: tcp
id: ioclog
tags: ['epics','ioclog']
max_message_size: 1MiB
host: "0.0.0.0:1514"
```
Ensure the ports are exposed from the container.
In the IOC startup script, setup the log as did for syslog-ng
# iocLogPrefix will fail for EPICS 3, but who's using EPICS 3 still???
iocLogPrefix "[${IOC}] "
iocLogInit
errlog "starting ${IOC}"
```
hope that helps
Niko
From: Tech-talk <tech-talk-bounces at aps.anl.gov> on behalf of Dr. Simon Friederich via Tech-talk <tech-talk at aps.anl.gov> Sent: Friday, January 26, 2024 9:02 AM To: tech-talk at aps.anl.gov <tech-talk at aps.anl.gov> Subject: External: IOC Logging
Dear EPICS community,
I am currently investigating what options I have for storing the logs from our IOCs centrally.
I have set up a syslog-ng docker container for testing purposes.
The host server has the IP 10.32.240.32, the docker container has published ports 514 (UDP), 601 (TCP).
For testing purposes, I used a client in the same subnet with the command
logger -n 10.32.240.32 "my_message"
successfully left a message.
Now I have set the environment variables (on the client) in epics-base/configure/CONFIG_SITE_ENV.
EPICS_IOC_LOG_INET=10.32.240.32
EPICS_IOC_LOG_PORT=601
In a simple test IOC on the client, I say
iocLogInit()
and get the message
epics> log client: connected to log server at '10.32.240.32:601'
I now wanted to test whether I can send a message with errlog:
epics> errlog("my message")
However, after a short time (some seconds) I get:
epics> log client: lost contact with log server at '10.32.240.32:601'
because "Broken pipe"
Then a short time later the IOC reconnects to the log server.
log client: connected to log server at '10.32.240.32:601'
Have I overlooked something in the configuration?
I am also open to alternatives (e.g. logstash?).
Many thanks and best regards
Simon
--
Dr. Simon Friederich
Institut für Kernphysik
Kollaboration B | MESA
Johannes Gutenberg-Universität Mainz
Johann-Joachim-Becher-Weg 45
D 55128 Mainz
Tel.: +49 (0)6131 39-23160
E-Mail: s.friederich at uni-mainz.de