Cannot get collector to pick up new local source
We have been seeing an issue where new sources are not getting picked up by the collectors (both via Chef and manual installation). I thought I had tracked it down to the fact that we were not defining the syncSources parameter in our user.properties file, however I added it to the file like so:
accessid=******
name=******
sources=/etc/sumo.json
syncSources=/etc/sumo.json
installerMode=true
ephemeral=true
wrapper.debug=TRUE
wrapper.filter.trigger.1000=java.lang.OutOfMemoryError
Once that was added I restarted the collector service, however it is not picking up the new source I added to /etc/sumo.json:
~# ll /etc/ | grep sumo
-rw-r--r-- 1 root root 1674 Nov 20 21:19 sumo.json
{
"sourceType" : "LocalFile",
"name" : "Kernel Log",
"pathExpression" : "/var/log/kern.log",
"timeZone": "UTC",
"automaticDateParsing": true,
"forceTimeZone": false,
"filters": []
}
Has anyone run into similar issues? I'm tearing my hair out over this.
-
Hi Peter,
If your Collector was not initially installed with the syncSources property set it would have been installed in UI management mode. In order to switch a Collector to start using the JSON file for management you'll need to perform the following steps.
1.) Within the Collector Management pages of the Sumo Logic UI select to edit the Collector. Under the "Advanced" section of the configuration, you'll need to select the option for "Local Configuration File" under the Collector Management options. (alternatively, you can set this with the Collector Management API)
2.) Update your user.properties file on the Collector to add the syncSources parameter, along with the path to your JSON file.
3.) Restart the Collector to apply the update.
As long as your JSON file is valid you should start seeing your updates apply immediately. An example of the file format for sync mode can be found in the following help documentation.
Please sign in to leave a comment.
Comments
1 comment