3 ms·

Would be interesting to hear if qryn (née cloki - clickhouse Loki) with vector might be a valid alternative to both Loki and traditional syslog. AFAIK logshipp

by e12e 4y ago

Would be interesting to hear if qryn (née cloki - clickhouse Loki) with vector might be a valid alternative to both Loki and traditional syslog. AFAIK logshipping with journald is bespoke - but vector should be able to handle both syslog and journald - for relatively painless setup ... Not sure if tailing is better with qryn though. https://github.com/metrico/qryn https://github.com/metrico/qryn https://vector.dev/docs/reference/configuration/sources/syslog/ https://vector.dev/docs/reference/configuration/sources/sysl... https://vector.dev/docs/reference/configuration/sources/journald/ https://vector.dev/docs/reference/configuration/sources/jour... https://www.digitalocean.com/community/tutorials/how-to-centralize-logs-with-journald-on-debian-10 https://www.digitalocean.com/community/tutorials/how-to-cent...

chrnola 4y ago
Oh interesting. I like that qryn exposes Grafana compatible query APIs. I’ve been playing with SigNoz (another Clickhouse-based, OTel compatible project for ingesting and analyzing logs, metrics, and traces) and I wish it would offer the same capability.
- qxip 4y ago
  Thanks for the feedback! qryn developer here, and that's exactly our design goal: requiring no custom agents or clients in order to use our solution, through API emulation. There's a chance you could use qryn as a reader for data written by other clients, and that's exactly what we do with opentelemetry where we have a qryn-otel-collector allowing direct writes into ClickHouse at max speed, just like signoz, and reading through our Grafana compatible APIs using qryn.dev or qryn.cloud
  - e12e 4y ago
    But there are no straight up syslog/journald adapters?
qxip 4y ago
qryn and vector get along very well! We use it all the time for testing and developing qryn and qryn.cloud and most of our users love it! But since qryn supports Logs, Metrics and Telemetry at once, we're just as compatible with any Agent supporting Loki/LogQL, Influx protocol for metrics and logs, Elastic Bulk, Prometheus for metrics, opentelemetry for everything... and more coming! Feel free to open an issue on our repository if you end up trying it and/or would like us to help out! https://qryn.dev https://qryn.dev https://qryn.cloud https://qryn.cloud
- e12e 4y ago
  Thank you. In this case,it was more a reference to: > Our central syslog server is a central source of accessible, text based truth. It requires almost no infrastructure to be working on any machine in order to get logs to it and accept logs (...) From the linked post on central log server (and Loki): https://utcc.utoronto.ca/~cks/space/blog/sysadmin/GrafanaLokiAndCentralSyslogs https://utcc.utoronto.ca/~cks/space/blog/sysadmin/GrafanaLok... Unfortunately, AFAIK journald and qryn don't speak rsyslog - so you'll need something "alien" - all though vector seems very straightforward.

by e12e 4y ago

chrnola 4y ago

Oh interesting. I like that qryn exposes Grafana compatible query APIs. I’ve been playing with SigNoz (another Clickhouse-based, OTel compatible project for ingesting and analyzing logs, metrics, and traces) and I wish it would offer the same capability.

qxip 4y ago
Thanks for the feedback! qryn developer here, and that's exactly our design goal: requiring no custom agents or clients in order to use our solution, through API emulation. There's a chance you could use qryn as a reader for data written by other clients, and that's exactly what we do with opentelemetry where we have a qryn-otel-collector allowing direct writes into ClickHouse at max speed, just like signoz, and reading through our Grafana compatible APIs using qryn.dev or qryn.cloud
- e12e 4y ago
  But there are no straight up syslog/journald adapters?

qxip 4y ago

qryn and vector get along very well! We use it all the time for testing and developing qryn and qryn.cloud and most of our users love it! But since qryn supports Logs, Metrics and Telemetry at once, we're just as compatible with any Agent supporting Loki/LogQL, Influx protocol for metrics and logs, Elastic Bulk, Prometheus for metrics, opentelemetry for everything... and more coming! Feel free to open an issue on our repository if you end up trying it and/or would like us to help out! https://qryn.dev https://qryn.dev https://qryn.cloud https://qryn.cloud

e12e 4y ago
Thank you. In this case,it was more a reference to: > Our central syslog server is a central source of accessible, text based truth. It requires almost no infrastructure to be working on any machine in order to get logs to it and accept logs (...) From the linked post on central log server (and Loki): https://utcc.utoronto.ca/~cks/space/blog/sysadmin/GrafanaLokiAndCentralSyslogs https://utcc.utoronto.ca/~cks/space/blog/sysadmin/GrafanaLok... Unfortunately, AFAIK journald and qryn don't speak rsyslog - so you'll need something "alien" - all though vector seems very straightforward.