Email Alerting like Splunk
Last updated
Was this helpful?
Last updated
Was this helpful?
is a great tool for searching logs. One of its key features is the ability to grep
logs and send alert emails when certain conditions are met.
In this little HowTo article, we will show you how to build a similar system using Fluentd. More specifically, we will create a system that sends an alert email when it detects a 5xx HTTP status code in an Apache access log.
If you want a more general introduction to use Fluentd as a free alternative to Splunk, see the article .
The following software/services are required to be set up correctly:
(fluent-plugin-grepcounter)
(fluent-plugin-mail)
You can install Fluentd via major packaging systems.
If out_grepcounter
(fluent-plugin-grepcounter) and out_mail
(fluent-plugin-mail) are not installed yet, please install it manually.
See section how to install fluent-plugin-mongo on your environment.
Here is the full configuration example (copy and edit as needed):
Save your settings to /etc/fluent/fluentd.conf
(If you installed Fluentd without fluent-package
, save the content as alert-email.conf
instead).
Before proceeding, please confirm:
The SMTP configuration is correct. You need a working mail server
and a proper recipient address to run this example.
The access log file has proper file permission. You need to make
the file readable to the fluentd
daemon.
The configuration above consists of three main parts:
The first <source>
block sets the httpd
log file as an event source for the daemon.
The second <match>
block tells Fluentd to count the number of 5xx responses per time window (3 seconds). If the number exceeds (or is equal to) the given threshold, Fluentd will emit an event with the tag error_5xx.apache.access
.
The third <match>
block accepts events with the tag error_5xx.apache.access
, and send an email to alert@example.com
per event.
In this way, fluentd now works as an email alerting system that monitors the web service for you.
After saving the configuration, restart the fluentd
process:
If you installed the standalone version of Fluentd, launch the fluentd
process manually:
Then, generate some 5xx errors in the web server. If you do not have a convenient way to accomplish this, appending 5xx lines to the log file manually will produce the same result.
Now you will receive an alert email titled "HTTP SERVER ERROR".
Admittedly, this is a contrived example. In reality, you would set the threshold higher. Also, you might be interested in tracking 4xx pages as well. In addition to Apache logs, Fluentd can handle Nginx logs, syslogs, or any single- or multi-lined logs.
You can learn more about Fluentd and its plugins by:
exploring other
asking questions on the
If this article is incorrect or outdated, or omits critical information, please . is an open-source project under . All components are available under the Apache 2 License.