Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Aggregate your syslog messages & filter for those that matter in real time.

branch: master

Fetching latest commit…

Octocat-spinner-32-eaf2f5

Cannot retrieve the latest commit at this time

Octocat-spinner-32 bin
Octocat-spinner-32 lib
Octocat-spinner-32 node_modules
Octocat-spinner-32 test
Octocat-spinner-32 .gitignore
Octocat-spinner-32 MIT-LICENSE.txt
Octocat-spinner-32 README.org
Octocat-spinner-32 package.json
README.org

Aggregate your syslog messages & filter for those that matter in real time.

How It Works

Tails acts as a syslog server, collecting messages via UDP. Messages are delivered to your browser using an HTML 5 WebSocket.

The browser is responsible for message filtering, separating them into defined “streams”.

You can create steams, each with their own filter terms.

Streams can be forwarded to loggly, a cloud based logging platform.

For example:

You could tail SSH logins with the term:

sshd

Or ignore LDAP messages with the term:

!slapd

Loggly forwarding requires a JSON enabled HTTP input. Each stream has a URL token unique to a Loggly input (Stream Settings).

Messages are non-persistent and they are automatically pruned.

Demo

Available here.

Install & Configure

Server

Install with Chef

For those who use OpsChef, a cookbook is available here.

Install Node.js & NPM

Please refer to Joyent’s fantastic documentation.

Install Tails

npm install tails -g

Run

Node.js process monitoring is outside the scope of this readme, you can run with nohup.

tails -h
usage: tails [options]
options:
  --syslog PORT   Default: 5140
  --http PORT     Default: 8080

nohup tails &

Clients

Append the following to your prefered syslog service configuration file.

Replace “tails.example.ca” with the hostname or IP address of your server running Tails.

Be sure to configure the correct port, Tails listens on 5140 by default.

Rsyslog

$template FwdTails,"<%PRI%>%TIMESTAMP% %HOSTNAME% %APP-NAME% %PROCID% %msg%"
$ActionForwardDefaultTemplate FwdTails
*.* @tails.example.ca:5140

Syslog-ng

destination tails { udp("tails.example.ca" port(5140)); };
log { source(s_all); destination(tails); };

Restart the service after making the change.

What’s Next

  • [ ] Clean up client side Javascript
  • [ ] Take a snapshot of a stream (persist)
  • [ ] Export a stream snapshot to JSON or CSV

CRUD

curl -id 'name=foo' localhost:8080/streams

curl -i localhost:8080/streams
  {"foo":{"name":"foo","terms":[],"forwarding":{"enabled":false,"token":""}}}

curl -id 'term=bar' localhost:8080/streams/foo/terms

curl -i localhost:8080/streams
  {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":false,"token":""}}}

curl -id 'token=loggly-input-token' localhost:8080/streams/foo/forwarding

curl -i localhost:8080/streams
  {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":true,"token":"loggly-input-token"}}}

curl -iX DELETE localhost:8080/streams/foo/terms/bar

curl -iX DELETE localhost:8080/streams/foo

Contributors

Sean Porter

Justin Kolberg

Something went wrong with that request. Please try again.