Stackdriver Logs – Why No sshd Logs on Stackdriver?

google-cloud-platformgoogle-stackdriverssh

On a GCP Compute Engine instance, OS is Ubuntu 18.04, Stackdriver logging agent is installed.

Any idea why Stackdriver doesn't ingest auth.log by default? What would be the best way to do it?

Best Answer

Ended up simply adding an additional entry in /etc/google-fluentd/config.d/syslog.conf

<source>
  @type tail

  # Parse the timestamp, but still collect the entire line as 'message'
  format /^(?<message>(?<time>[^ ]*\s*[^ ]* [^ ]*) .*)$/

  path /var/log/auth.log
  pos_file /var/lib/google-fluentd/pos/auth.log.pos
  read_from_head true
  tag auth
</source>
Related Topic