How to set up log forwarding in KeyCDN and log events to a dedicated log file with Rsyslog

Written by Claudio Kuenzler - 0 comments

Published on June 17th 2022 - last updated on June 17th 2022 - Listed in Linux Cloud Network Internet

---

Content Delivery Networks (CDNs) are helpful for caching and delivering content across the globe, lowering your own bandwidth for assets (such as images or videos). KeyCDN is such a CDN provider.

There is one slight problem though: When you need to troubleshoot connections to a CDN provider you (mostly) can't see any access logs as you would on your own web server. But luckily KeyCDN (and maybe also others) provides a log forwarding using the syslog protocol. And with a proper rsyslog configuration, the KeyCDN logs can be written into a dedicated log file.

Log forwarding in KeyCDN

The setup part in the KeyCDN account is pretty straightforward. There's not much you can do wrong. In the navigation, select Account -> Log forwarding and you're greeted with a basic "Log forwarding" form.

Enter your own syslog server's FQDN or IP and the syslog server's listener port (default 514). Note that only UDP is supported.

Configure syslog server (Rsyslog)

First you need to make sure that Rsyslog accepts logs from remote servers and actually listens on a port. This is (usually) configured in /etc/rsyslog.conf by enabling the "imudp" (UDP input module):

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

Another port can also be used, of course. But don't forget to update the log forwarding settings in KeyCDN then.

When the logs arrive on the syslog server (running with Rsyslog 8.2001 on Ubuntu 20.04), they should be written into a dedicated log file (/var/log/keycdn.log) instead of being mixed up with all kinds of other log events in /var/log/syslog.

To achieve this, a small configuration snippet needs to be added in /etc/rsyslog.d:

root@syslog:~# cat /etc/rsyslog.d/10-keycdn.conf
if $hostname == 'keycdn' then {
  action(type="omfile" File="/var/log/keycdn.log")
  stop
}

To understand this snippet better:

• $hostname == 'keycdn': Interestingly the logs from KeyCDN are shipped with the hostname field being just "keycdn". There are no IPs or FQDNs shown in the raw log message. As the logs can be received from all kinds of KeyCDN servers with different IPs and in different network ranges, it makes sense to check for the "hostname" and match it with the "keycdn" value
• action: If the condition matches, then rsyslog is told to do an action. In this case it should use the "file output module" (omfile) and use the file path "/var/log/keycdn.log"
• stop: Rsyslog is then told to stop processing these logs. Without stop the logs would continue to be processed by (further) rsyslog configs

Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.