+TITLE: Aggregate your syslog messages & filter for those that matter in real time.

• How It Works Tails acts as a syslog server, collecting messages via UDP. Messages are delivered to your browser using an HTML 5 WebSocket.

  The browser is responsible for message filtering, separating them into defined "streams".

  You can create steams, each with their own filter terms.

  Streams can be forwarded to [[http://loggly.com/][loggly]], a cloud based logging platform.

  For example:

  You could tail SSH logins with the term: : sshd

  Or ignore LDAP messages with the term: : !slapd

  Loggly forwarding requires a [[http://loggly.com/blog/2011/06/on-the-way-to-impressive/][JSON enabled HTTP input]]. Each stream has a URL token unique to a Loggly input (Stream Settings).

  Messages are non-persistent and they are automatically pruned.

• Demo Available [[http://portertech.no.de][here]].

• Install & Configure ** Server *** Install with Chef For those who use OpsChef, a cookbook is available [[https://github.com/portertech/cooking-tails][here]].

*** Install Node.js & NPM Please refer to Joyent's fantastic [[https://github.com/joyent/node/wiki/Installation][documentation]].

*** Install Tails : npm install tails -g

*** Run Node.js process monitoring is outside the scope of this readme, you can run with nohup. : tails -h : usage: tails [options] : options: : --syslog PORT Default: 5140 : --http PORT Default: 8080 : : nohup tails &

** Clients Append the following to your prefered syslog service configuration file.

Replace "tails.example.ca" with the hostname or IP address of your server running Tails.

Be sure to configure the correct port, Tails listens on 5140 by default.

** Rsyslog : $template FwdTails,"<%PRI%>%TIMESTAMP% %HOSTNAME% %APP-NAME% %PROCID% %msg%" : $ActionForwardDefaultTemplate FwdTails : .* @tails.example.ca:5140

*** Syslog-ng : destination tails { udp("tails.example.ca" port(5140)); }; : log { source(s_all); destination(tails); };

Restart the service after making the change.

• What's Next

  • [ ] Clean up client side Javascript
  • [ ] Take a snapshot of a stream (persist)
  • [ ] Export a stream snapshot to JSON or CSV

• CRUD : curl -id 'name=foo' localhost:8080/streams : : curl -i localhost:8080/streams : {"foo":{"name":"foo","terms":[],"forwarding":{"enabled":false,"token":""}}} : : curl -id 'term=bar' localhost:8080/streams/foo/terms : : curl -i localhost:8080/streams : {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":false,"token":""}}} : : curl -id 'token=loggly-input-token' localhost:8080/streams/foo/forwarding : : curl -i localhost:8080/streams : {"foo":{"name": "foo", "terms":["bar"],"forwarding":{"enabled":true,"token":"loggly-input-token"}}} : : curl -iX DELETE localhost:8080/streams/foo/terms/bar : : curl -iX DELETE localhost:8080/streams/foo

• Contributors [[https://github.com/portertech][Sean Porter]]

  [[https://github.com/amdprophet][Justin Kolberg]]