diff --git a/Dockerfile b/Dockerfile index 10a8270..05f897d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,8 +9,8 @@ RUN go mod download COPY code/* /code/ FROM base as build -RUN go build -o main *.go \ - && zip lambda.zip main +RUN go build -o bootstrap *.go \ + && zip lambda.zip bootstrap FROM base as test RUN go test @@ -21,4 +21,4 @@ RUN golangci-lint run . FROM alpine as release WORKDIR /code COPY --from=build /code/lambda.zip /code/ -VOLUME /code \ No newline at end of file +VOLUME /code diff --git a/README.md b/README.md index b6f8b99..5cd946f 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# lm-logs-aws-integration +# lm-logs-aws-integration (beta) This integration provides a CloudFormation template to forward logs from AWS CloudWatch to LogicMonitor. This CloudFormation template only deploys a log forwarder (lambda function) subscribed to a specific CloudWatch logs group for LogicMonitor. @@ -8,9 +8,12 @@ You will need to supply the following LogicMonitor credentials when configuring * LM Access ID * LM Access Key * LM Account Name +* LM Account Domain + +**NOTE**: If the LM Account Domain is not specified, it defaults to "logicmonitor.com". ### Deploying lambda using CloudFormation -[![Launch Stack](https://s3.amazonaws.com/cloudformation-examples/cloudformation-launch-stack.png)](https://console.aws.amazon.com/cloudformation/home#/stacks/create/review?stackName=lm-forwarder&templateURL=https://logicmonitor-logs-forwarder.s3.amazonaws.com/source/latest.yaml) +[![Launch Stack](https://s3.amazonaws.com/cloudformation-examples/cloudformation-launch-stack.png)](https://console.aws.amazon.com/cloudformation/home#/stacks/create/review?stackName=lm-forwarder&templateURL=https://logicmonitor-logs-forwarder.s3.us-west-1.amazonaws.com/source/latest.yaml) ### Deploying lambda using Terraform **Sample configuration** @@ -27,6 +30,10 @@ variable "lm_company_name" { description = "LogicMonitor Account Name" } +variable "lm_company_domain" { + description = "LogicMonitor Account Domain" +} + # LogicMonitor Logs forwarder resource "aws_cloudformation_stack" "lm_forwarder" { name = "lm-forwarder" @@ -36,13 +43,14 @@ resource "aws_cloudformation_stack" "lm_forwarder" { LMAccessId = var.lm_access_id LMAccessKey = var.lm_access_key LMCompanyName = var.lm_company_name + LMCompanyDomain = var.lm_company_domain LMRegexScrub = "" PermissionsBoundaryArn = "" } - template_url = "https://lm-logs-forwarder-v2.s3.amazonaws.com/latest.yaml" + template_url = "https://logicmonitor-logs-forwarder.s3.us-west-1.amazonaws.com/source/latest.yaml" } ``` -`terraform apply --var 'lm_access_id=' --var 'lm_access_key=' --var 'lm_company_name='` +`terraform apply --var 'lm_access_id=' --var 'lm_access_key=' --var 'lm_company_name=' --var 'lm_company_domain='` ### Forwarding EC2 Instances logs Forward EC2 logs to CloudWatch, using the [CloudWatch Logs Agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html). @@ -77,6 +85,21 @@ To send Lambda logs to LogicMonitor, go to cloudwatch and find lambda's log grou 1. Go to Cloudwatch, select the lambda's log group of which you want to forward logs , under Actions > Create Lambda subscription filter 2. In Create Lambda subscription filter , select "Lambda Function" and choose "LMLogsForwarder" (or, whatever you named the Lambda function during stack creation) and click Start streaming. +### Forwarding EKS logs +Add an "Amazon CloudWatch Observability" plugin to existing or new cluster, OR +Forward EKS logs to cloudwatch using [application metrics to cloudwatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-setup-metrics.html) and [application logs to cloudwatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-EKS-logs.html) using [Fluenbit](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-setup-logs-FluentBit.html) + +These steps create 5 different log groups into cloudwatch as below: +1. /aws/containerInsights//application +2. /aws/containerInsights//host +3. /aws/containerInsights//performance +4. /aws/containerInsights//dataplane +5. /aws/eks//cluster + +To forward EKS logs to LogicMonitor, follow these steps for the specific log group you want to send: +1. Go to Cloudwatch, select the EKS's log group of which you want to forward logs , under Actions > Create Lambda subscription filter +2. In Create Lambda subscription filter , select "Lambda Function" and choose "LMLogsForwarder" (or, whatever you named the Lambda function during stack creation) and click Start streaming. + ### Send flow logs from EC2 1. Add below lines in permissions of lambda's role policy: "logs:CreateLogGroup", @@ -141,119 +164,114 @@ For Error logging: As these logs are filtered from Cloudtrail, all the Cloudtrail steps needs to be implemented. No separate process is needed for ECS. ### Send ELB flow logs -ELB flow logs to ECS: - -1. Add below lines in permissions of lambda's role policy: +1.Add below lines in permissions of lambda's role policy: "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" - 2. Add below line in the Trust Relationship part of the role in the Service tag: - "vpc-flow-logs.amazonaws.com" - + "vpc-flow-logs.amazonaws.com" 3. A Log group in cloud watch should be created with name /aws/elb/networkInterface - 4. Use your ELB name to search in Network interfaces page. Select that Network interface row and create a flow log. In create flow log Destination log group should be /aws/elb/networkInterface and IAM role should be the role created in 1st and 2nd step. - -5. Go to /aws/elb/networkInterface log group. In Actions > Subscription filters > Create lambda subscription filter. In lambda function select “LMLogsForwarder” (or whatever you named the Lambda function during stack creation) and provide Subscription filter name. Hit Start Streaming. - -6. Logs will start to propagate through lambda to LogIngest. +6. Go to /aws/elb/networkInterface log group. In Actions > Subscription filters > Create lambda subscription filter. In lambda function select “LMLogsForwarder” (or whatever you named the Lambda function during stack creation) and provide Subscription filter name. Hit Start Streaming. +7. Logs will start to propagate through lambda to LogIngest. ### Send RDS logs -RDS logs to ECS: - -1. Add below lines in permissions of lambda's role policy: +1.Add below lines in permissions of lambda's role policy: "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" - 2. Add below line in the Trust Relationship part of the role in the Service tag: "vpc-flow-logs.amazonaws.com" - 3. A Log group in cloud watch should be created with name /aws/rds/networkInterface - 4. Use your RDS instance private IP address to search in Network interfaces page. Select that Network interface row and create a flow log. In create flow log Destination log group should be /aws/rds/networkInterface and IAM role should be the role created in 1st and 2nd step. - 5. Go to /aws/rds/networkInterface log group. In Actions > Subscription filters > Create lambda subscription filter. In lambda function select “LMLogsForwarder” (or whatever you named the Lambda function during stack creation) and provide Subscription filter name. Hit Start Streaming. - 6. Logs will start to propagate through lambda to LogIngest. -### Send Fargate logs -Fargate logs of ECS: - -1. Go to Task defination that you are using with your service in ECS cluster - -2. It should have "awslogs-group" as key and "/aws/fargate" as value in Container definition section of Task definition. If you are adding to already existing task definition than create new revision of Task definition and update Service in ECS cluster. Else if creating a new Task defination then make sure to attach it to Service in ECS cluster. - -3. Go to /aws/fargate log group. In Actions > Subscription filters > Create lambda subscription filter. In lambda function select “LMLogsForwarder” (or whatever you named the Lambda function during stack creation) and provide Subscription filter name. Hit Start Streaming. - -4. Logs will start to propagate through lambda to LogIngest. - -Fargate logs from EKS: - -1. Create a dedicated Kubernetes namespace named aws-observability. - -2. Save the following contents to a file named aws-observability-namespace.yaml on your computer. The value for name must be aws-observability and the aws-observability: enabled label is required. - -kind: Namespace -apiVersion: v1 -metadata: - name: aws-observability - labels: - aws-observability: enabled - - -3. Create the namespace. - -Save the following contents to a file named aws-logging-cloudwatch-configmap.yaml. Replace region-code with the AWS Region. The parameters under [OUTPUT] are required. - -kind: ConfigMap -apiVersion: v1 -metadata: - name: aws-logging - namespace: aws-observability -data: - output.conf: | - [OUTPUT] - Name cloudwatch_logs - Match * - region region-code - log_group_name fluent-bit-cloudwatch - log_stream_prefix from-fluent-bit- - auto_create_group true - log_key log - - parsers.conf: | - [PARSER] - Name crio - Format Regex - Regex ^(?