Syslog 中的 Service Fabric Linux 群集事件Service Fabric Linux cluster events in Syslog

Service Fabric 公开一组平台事件,告知你群集中的重要活动。Service Fabric exposes a set of platform events to inform you of important activity in your cluster. 点击此处查看公开的完整事件列表。The full list of events that are exposed is available here. 可通过多种方式使用这些事件。There are variety of ways through which these events can be consumed. 在本文中,我们将讨论如何配置 Service Fabric,以便将这些事件写入 Syslog。In this article, we are going to discuss how to configure Service Fabric to write these events to Syslog.

备注

本文最近已更新,从使用术语“Log Analytics”改为使用术语“Azure Monitor 日志”。This article was recently updated to use the term Azure Monitor logs instead of Log Analytics. 日志数据仍然存储在 Log Analytics 工作区中,并仍然由同一 Log Analytics 服务收集并分析。Log data is still stored in a Log Analytics workspace and is still collected and analyzed by the same Log Analytics service. 我们正在更新术语,以便更好地反映 Azure Monitor 中日志的角色。We are updating the terminology to better reflect the role of logs in Azure Monitor. 有关详细信息,请参阅 Azure Monitor 术语更改See Azure Monitor terminology changes for details.

简介Introduction

在 6.4 版中就已引入了 SyslogConsumer,用于将 Service Fabric 平台事件发送到 Linux 群集的 Syslog。In the 6.4 release, the SyslogConsumer has been introduced to send the Service Fabric platform events to Syslog for Linux clusters. 开启后,事件将自动传递到可通过 Log Analytics 代理收集和发送的 Syslog。Once turned on, events will automatically flow to Syslog which can be collected and sent by the Log Analytics Agent.

每个 Syslog 事件均有 4 个组件Each Syslog event has 4 components

  • 设施Facility
  • 标识Identity
  • MessageMessage
  • 严重性Severity

SyslogConsumer 使用 Local0 设施写入所有平台事件。The SyslogConsumer writes all platform events using Facility Local0. 更改 config 配置可更新为任何有效的设施。使用的标识是 ServiceFabricYou can update to any valid facility by changing the config config. The Identity used is ServiceFabric. 消息字段包含在 JSON 中序列化的整个事件,以便可通过各种工具查询和使用。The Message field contains the whole event serialized in JSON so that it can be queried and consumed by a variety of tools.

启用 SyslogConsumerEnable SyslogConsumer

要启用 SyslogConsumer,你需要将自己的群集升级。To enable the SyslogConsumer, you need to perform an upgrade of your cluster. 需要使用以下代码更新 fabricSettings 部分。The fabricSettings section needs to be updated with the following code. 请注意,此代码仅包含与 SyslogConsumer 相关的部分Note this code just includes sections related to SyslogConsumer

    "fabricSettings": [
        {
            "name": "Diagnostics",
            "parameters": [
            {
                "name": "ConsumerInstances",
                "value": "AzureWinFabCsv, AzureWinFabCrashDump, AzureTableWinFabEtwQueryable, SyslogConsumer"
            }
            ]
        },
        {
            "name": "SyslogConsumer",
            "parameters": [
            {
                "name": "ProducerInstance",
                "value": "WinFabLttProducer"
            },
            {
            "name": "ConsumerType",
            "value": "SyslogConsumer"
            },
            {
                "name": "IsEnabled",
                "value": "true"
            }
            ]
        },
        {
            "name": "Common",
            "parameters": [
            {
                "name": "LinuxStructuredTracesEnabled",
                "value": "true"
            }
            ]
        }
    ],

下面是需要说明的更改Here are the changes to call out

  1. 在 Common 部分中,有一个名为 LinuxStructuredTracesEnabled 的新参数。In the Common section, there is a new parameter called LinuxStructuredTracesEnabled. 这就要求在将 Linux 事件发送到 Syslog 时,将它们组织起来并串行化。 This is required to have Linux events structured and serialized when sent to Syslog.
  2. 在 Diagnostics 部分中,添加了一个新的 ConsumerInstance:SyslogConsumer。In the Diagnostics section, a new ConsumerInstance: SyslogConsumer has been added. 这就告诉平台还有另一个事件使用者。This tells the platform there is another consumer of the events.
  3. 新部分 SyslogConsumer 需要将 IsEnabled 设为 trueThe new section SyslogConsumer needs to have IsEnabled as true. 它已配置为自动使用 Local0 设施。It is configured to use the Local0 facility automatically. 你可以添加另一个参数来替代该设置。You can override this by adding another parameter.
    {
        "name": "New LogFacility",
        "value": "<Valid Syslog Facility>"
    }

Azure Monitor 日志集成Azure Monitor logs integration

可以使用 Azure Monitor 日志等监视工具来读取这些 Syslog 事件。You can read these Syslog events in a monitoring tool such as Azure Monitor logs. 你可以按照[说明].(../azure-monitor/learn/quick-create-workspace.md),使用 Azure 市场创建一个 Log Analytics 工作区。还需向群集添加 Log Analytics 代理,以向该工作区收集和发送该数据。You can create a Log Analytics workspace by using the Azure Marketplace using these [instructions].(../azure-monitor/learn/quick-create-workspace.md) You also need to add the Log Analytics agent to your cluster to collect and send this data to the workspace. 这正是用于收集性能计数器的同一个代理。This is the same agent used to collect performance counters.

  1. 导航到Advanced Settings边栏选项卡Navigate to the Advanced Settings blade

    工作区设置

  2. 单击 DataClick Data

  3. 单击 SyslogClick Syslog

  4. 将 Local0 配置为要跟踪的设施。如果在 fabricSettings 中进行了更改,可以再添加一个设施Configure Local0 as the Facility to track. You can add another Facility if you changed it in fabricSettings

    配置 Syslog

  5. 单击工作区资源菜单中的Logs可前往查询浏览器启动查询Head over to the query explorer by clicking Logs in the workspace resource's menu to start querying

    工作区日志

  6. 可以对 Syslog 表进行查询,查找作为 ProcessName 的 ServiceFabricYou can query against the Syslog table looking for ServiceFabric as the ProcessName. 下面的示例查询说明如何分析事件中的 JSON 并显示其内容The query below is an example of how to parse the JSON in the event and display its contents

        Syslog | where ProcessName == "ServiceFabric" | extend $payload = parse_json(SyslogMessage) | project $payload
    

    Syslog 查询

上面的示例为 NodeDown 事件。The example above is of a NodeDown event. 可在此处查看事件的完整列表。You can view the full list of events here.

后续步骤Next steps