## Overview

Opsview Monitor uses centralized logging so all components will log to the same syslog system. With a suitable setup, this means you can view log messages across multiple hosts in a single location.

By default Opsview Monitor uses `rsyslog` for log messages (`syslog-ng` may be used instead) and `logrotate` for log rotation.

To allow simple separation of Opsview log messages from other parts of the operating system, Opsview will log using the local6 facility.

This page explains the default configuration used by Opsview and some example changes that you can make for your system.

## Installation

When Opsview is installed, it will copy Opsview syslog configuration file `99-opsview.conf` to `/etc/syslog-ng/conf.d` and `/etc/rsyslog.d/conf.d`, depending on which software is installed.

If you have both types of syslog software installed, you may get conflicts.

Note: The configuration file will be re-installed on upgrade.

By default, Opsview will log to the system's main log file as well as `/var/log/opsview/opsview.log`.

Furthermore, `logrotate` will rotate the `/var/log/opsview/opsview.log` file.

## rsyslog

As part of the opsview-setup package, Opsview will configure rsyslogd by placing the configuration into `/etc/rsyslog.d/99-opsview.conf`.

The default configuration is for all log messages to be written to `/var/log/opsview/opsview.log`.

You can make changes to this file, but you will need to restart the rsyslog service.

Note, be aware that this file will be overwritten on an upgrade of opsview-setup.

### Examples

#### Separating destinations

This example shows how to use separate log files based on the component, or the log level.

#### Separating destinations based on components and log levels

To log error and warning messages from a particular component to separate log file:

#### Forwarding to remote syslog server

To send syslog messages to a remote server use: (this would for example be used on a collector to send the log messages to the orchestrator server)

#### Changing Permissions

To change permissions for the log file so that everyone can read but only syslog and root can write to the log file, add the following to the top:

### Troubleshooting

#### Directory Not Created

Restarting rsyslog should create the directory for the log files, if it doesn't already exist:

In some cases, you may also need to reboot the machine:

#### Log Rotation

As part of the opsview-setup package, Opsview will configure logrotate by placing the configuration into `/etc/logrotate.d/opsview-logging`.

The default is to rotate logs every day for 7 days.

Note: As part of an upgrade, this configuration file will be overwritten.

## syslog-ng

### Switching to syslog-ng after installing Opsview

If you install syslog-ng after Opsview has been installed, you must configure syslog-ng manually.

Firstly, install and configure `syslog-ng` as desired. Then run as root:

This will now log Opsview messages to `/var/log/opsview/opsview.log`. To test, run:

Check the log file to confirm this has been setup correctly.

## Webserver Logging

By default Opsview Monitor logs all web access separately - see [Webserver Logging](🔗)