JOIN GRAYLOG FOR OUR

ANNUAL CONFERENCE

Thursday,
October 21, 2021
10am-5pm CT
REGISTER NOW

Recommended Design for MacOS Logging Solution

Hi-

First post on this site. I have two questions.

First question: would this be the best site for general configuration and troubleshooting questions, or is there a dedicated Slack channel for that somewhere?

Second question, I have a use-case were a single macOS host with no connectivity to the internet needs to have its logs aggregated and stored for an entire year. I believe this can be done using Graylog but I am not sure how much engineering effort would go into designing a solution for a single host, and what backend I would need, example, a full Elastic cluster backend, or Mongo DB.

Also, its not clear to me which log shipper i would use on the Mac to support Apple’s UL framework, if that would be Filebeat and if so, would I use Logstash to get into Graylog?

Thanks in advance.

Hello && Welcome

I might be able to help.

This is the place to be for general info and help with troubleshooting. If its beyond that you can go here but I would start here first.

You might want to look at this → documentation first and any question arise from that come back here and we can help.
To be honest if you have a all-in-one node GL server would do it.

https://docs.graylog.org/docs/architecture#:~:text=of%20the%20indices.-,MINIMUM%20SETUP,-This%20is%20a

As for your log shipper FileBeat installation would do good.
Just a side note: Here is my FileBeat configuration on a remote client sending logs to Graylog. Don’t be confused with the name Logstash :slight_smile:

filebeat.inputs:
 - type: filestream  
   enabled: true
   # Paths that should be crawled and fetched. Glob based paths.
   paths:
     - /var/log/*.log

output.logstash:
  # The Logstash hosts
  hosts: ["graylog-server.com:5044"]

logging.level: debug
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat.log
1 Like

Thank you. That is exactly the info I was looking for. Do you know if Filebeats is able to grab all of the logging available under Apple’s UL framework? Thats where all of the good stuff is generated.

Since I am outputting LogStash, I presume the server will be a single node Elastic node, is that correct?

Any idea how long it might take to standup a simple solution like this for a reasonably competent Linunx admin?

Regards

Unfortunately I do not have apply device, but someone here might. I would assume that when you configure FileBeat paths: - /path/to/some/logs/*.log it should work. Just make sure Filebeat can access those logs (i.e. permissions).

Yes, your single node would have Graylog, Elasticsearch and MongoDb. In the documentation would have all you answers for this.

My first time after reading the documentation ( Copy & Pasting) about an hour.
It is highly recommended to go over what installation your using and how to install it. This will prevent those " Gotcha’s" later on.

After further thought, this solution might not work since Filebeat is path-based, as you pointed out.

To complicate things, Apple has mostly moved away from flat files for logging with their Unified Logging approach.

Anyway, I will keep reading the documentation in case something else jumps out at me.

Thank you!

I’ll keep my eyes open also. If I run into anything I’ll post it here. Sorry I cant be more help.

1 Like

I need a logging solution that can ingest and read Apple .tracev3 format. Looks like I have some work cut out for me.

Well… I did some research on Unified Logging and Activity Tracing with Apple. All I can say is wow.
There are tools out there that can read .tracev3 format and maybe they can create a text file for FileBeat to send those logs to Graylog. This was something I came across

1 Like

Good call. I came across that same Github project but did not take a close look at it. Potentially that could output plain text files that could in turn be shipped by LogStash to Greylog?

Yes that was what I was thinking.