Mailing-List: contact user-help@flume.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@flume.apache.org
Received-SPF: pass (nike.apache.org: domain of david.novogrodsky@gmail.com
 designates 209.85.192.54 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAEGKEUPXC7YhGJOH7bjOayXhcomRmTneEwdb8GLEmWUGrNt-PA@mail.gmail.com>
References: 
 <CALUpvHXcsv+uxCOxK7ceKrwHVE05KmUpHeAOgn7_sh2m9BK++Q@mail.gmail.com>
 <CAEGKEUPXC7YhGJOH7bjOayXhcomRmTneEwdb8GLEmWUGrNt-PA@mail.gmail.com>
From: David Novogrodsky <david.novogrodsky@gmail.com>
Date: Thu, 5 Feb 2015 17:51:51 -0600
Message-ID: 
 <CALUpvHVjaZyxiNPpYHr3rsOoCAACYa-WEwmuOasNGnLjx49i0g@mail.gmail.com>
Subject: Re: Newbie question on using the Syslog agent in Flume
To: user@flume.apache.org
Content-Type: text/plain; charset=UTF-8

Thank you for the information.
David Novogrodsky
david.novogrodsky@gmail.com
http://www.linkedin.com/in/davidnovogrodsky


On Mon, Nov 24, 2014 at 5:49 PM, Joey Echeverria <joey@cloudera.com> wrote:
> The host in your source config should be the hostname that will be
> listening for syslog events. It's typically either 0.0.0.0 to listen
> on the wildcard interface or the fully qualified hostname/IP address
> of the public network interface on the Flume agent.
>
> You then configure the host that will send syslog events to Flume with
> the Flume agent's hostname and the port you've configured. Here's an
> article that shows how to configure rsyslog and syslog-ng to send to a
> server:
>
> http://help.papertrailapp.com/kb/configuration/configuring-remote-syslog-from-unixlinux-and-bsdos-x/
>
> -Joey
>
> On Mon, Nov 24, 2014 at 3:25 PM, David Novogrodsky
> <david.novogrodsky@gmail.com> wrote:
>> All,
>>
>> I am new to the Hadoop Ecosystem.  I have a question about Syslog and the
>> Flume agent for Syslog.
>>
>> I am working to ingest network data from an agent.  The agent is sending
>> data in Syslog format, or is creating data in syslog format.  Here are the
>> required parameters for a syslog Flume source:
>>
>> a1.sources = r1
>> a1.channels = c1
>> a1.sources.r1.type = syslogudp
>> a1.sources.r1.port = 5140
>> a1.sources.r1.host = localhost
>>
>> a1.sources.r1.channels = c1
>>
>>
>>
>> I asked the developer for the IP address of the syslog source.  I assume
>> that the Flume agent sends an agent program to the syslog server, defined by
>> a1.source.r1.host.  Is this correct?  Or is the a1.sources.c1.host IP
>> address, the address of the machine that is running the Flume instance?
>>
>> David Novogrodsky
>> david.novogrodsky@gmail.com
>> http://www.linkedin.com/in/davidnovogrodsky
>
>
>
> --
> Joey Echeverria