Switch branches/tags
Nothing to show
Find file
Fetching contributors…
Cannot retrieve contributors at this time
95 lines (70 sloc) 3.01 KB

Aggregate your syslog messages & filter for those that matter in real time.

How It Works

Tails acts as a syslog server, collecting messages via UDP. Messages are delivered to your browser using an HTML 5 WebSocket.

The browser is responsible for message filtering, separating them into defined “streams”.

You can create steams, each with their own filter terms.

Streams can be forwarded to loggly, a cloud based logging platform.

For example:

You could tail SSH logins with the term:


Or ignore LDAP messages with the term:


Loggly forwarding requires a JSON enabled HTTP input. Each stream has a URL token unique to a Loggly input (Stream Settings).

Messages are non-persistent and they are automatically pruned.


Available here.

Install & Configure


Install with Chef

For those who use OpsChef, a cookbook is available here.

Install Node.js & NPM

Please refer to Joyent’s fantastic documentation.

Install Tails

npm install tails -g


Node.js process monitoring is outside the scope of this readme, you can run with nohup.

tails -h
usage: tails [options]
  --syslog PORT   Default: 5140
  --http PORT     Default: 8080

nohup tails &


Append the following to your prefered syslog service configuration file.

Replace “” with the hostname or IP address of your server running Tails.

Be sure to configure the correct port, Tails listens on 5140 by default.


$template FwdTails,"<%PRI%>%TIMESTAMP% %HOSTNAME% %APP-NAME% %PROCID% %msg%"
$ActionForwardDefaultTemplate FwdTails


destination tails { udp("" port(5140)); };
log { source(s_all); destination(tails); };

Restart the service after making the change.

What’s Next

  • [ ] Clean up client side Javascript
  • [ ] Take a snapshot of a stream (persist)
  • [ ] Export a stream snapshot to JSON or CSV


curl -id 'name=foo' localhost:8080/streams

curl -i localhost:8080/streams

curl -id 'term=bar' localhost:8080/streams/foo/terms

curl -i localhost:8080/streams
  {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":false,"token":""}}}

curl -id 'token=loggly-input-token' localhost:8080/streams/foo/forwarding

curl -i localhost:8080/streams
  {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":true,"token":"loggly-input-token"}}}

curl -iX DELETE localhost:8080/streams/foo/terms/bar

curl -iX DELETE localhost:8080/streams/foo


Sean Porter

Justin Kolberg