Promtail expect RFC 5424 log format

[simonbouchard]

Hello,

I am having an issue and I need guidance. My Promtail agent is complaining about the log format received from resticprofile. It expect them to be in RFC 5424 format, this is what I see within the Promtail's log:

msg="error initializing syslog stream" err="invalid or unsupported framing. first byte: 'ÿ'"

I found out that within the docker-composer file here that resticprofile has logging options set with syslog-format: rfc5424 but I can't find within the documentation how to configure this as a standalone installation.

The only bit of configuration options I found (and I have in place) is:

  backup:
    ...
    schedule-permission: user
    schedule-lock-wait: 10m
    schedule-log: tcp://0.0.0.0:514
    ...

The objective is to log all the backups of approximately ~300 cloud instances and visualize them withing Grafana using this dashboard. Each instance has Resticprofile installed in a stand alone fashion way, along with the Promtail agent.

Thank you!

[creativeprojects]

The docker-compose file instructs the docker service to redirect messages from the container standard output to a syslog server. It's completely transparent to resticprofile.

So in your case, I think you need the --log flag: https://creativeprojects.github.io/resticprofile/configuration/logs/index.html#command-line

Would that work for you?

[thiscantbeserious]

I think there's something bugged within resticprofiles syslog-server implementation that's not working anymore

When I do

resticprofile --log udp://mysyslogserver:1514 backup

or

resticprofile --log tcp://mysyslogserver:1514 backup

with either promtail or syslog-ng -> promtail

it will not error out but it continues to print to the console (it will error out however if there is no server)

and no logs are ever properly recieved by the syslog server.

Well there is something sent but its seemingly discarded ?.

I noticed that when I do use promtail directly it will log out an error that there is a bad character of some sort logged out (not sure if that was the correct message ...), so it does actually send something ... but that can't be fixed even by the format itself because I tried putting syslog-ng in front of it to parse all kind of log formats properly, like recommended by the documentation of promtail ...

... but that now just does not show anything - maybe it opens the stream and never actually forwards any data?

if I do forward the stdout/stderr from restricprofile like this:

resticprofile backup 2>&1 | logger -n mysyslogserver -P 1514

it works fine ...

[creativeprojects]

Which version of resticprofile are you using? (latest release or latest code from master branch?)

I tried on my machine sending logs to syslog-ng (inside a local container: https://hub.docker.com/r/linuxserver/syslog-ng)

When I send via udp it works fine. When I send over tcp nothing is coming through, although resticprofile doesn't seem to notice. I'm using the syslog package from the go standard library and it's not throwing an error. 🤔