{"id":2998,"date":"2013-10-02T09:00:12","date_gmt":"2013-10-02T13:00:12","guid":{"rendered":"http:\/\/dougmcclure.net\/blog\/?p=2998"},"modified":"2013-10-01T23:47:15","modified_gmt":"2013-10-02T03:47:15","slug":"using-netcat-to-stream-logs-to-scala-v1102","status":"publish","type":"post","link":"https:\/\/dougmcclure.net\/blog\/2013\/10\/using-netcat-to-stream-logs-to-scala-v1102\/","title":{"rendered":"Using Netcat to Stream Logs to SCALA v1102"},"content":{"rendered":"<p>I&#8217;ve been working on our big demo for the upcoming IOD Big Data and Analytics conference in November where we&#8217;ll highlight our Smart Cloud Analytics portfolio and ran into what&#8217;s likely a common challenge in many client environments.<\/p>\n<p>We include the right to use the IBM Tivoli Log File Agent (LFA) and I was happily going down the path to install the LFA on some remote systems. All was fine until I came to a system that the LFA installer complained about not having enough disk space. I started the normal tasks of looking for big files, tarballs, etc. to whack and was able to do that some, but whatever was installed wasn&#8217;t budging and \/ was 100% full. Wherever I attempted to install the LFA where space was available it still complained as it was checking \/tmp for space.<\/p>\n<p>So, what am I to do? I thought about using the SCALA local LFA and trying out the remote SSH pull method but then I recalled a recent client request to show a simple approach for sending a log file from a remote system as if they were running a tail -F on that remote system and sending the log to SCALA.  In their case, they didn&#8217;t want burden their end user with having any requisite knowledge of the LFA, how to install or configure it. Makes sense to me.<\/p>\n<p>So, with a little Google-foo I can show you how to use netcat to execute a tail -F on a remote system file and stream that to the SCALA system where netcat is listening and creates a local copy of that remote system file which is picked up for indexing in SCALA.<\/p>\n<p><strong>Notes:<\/strong><\/p>\n<ul>\n<li>Be aware of your corporate security policies!<\/li>\n<li>The contents of the file to be streamed across the network are not encrypted. (there are variants of netcat that support ssl, encryption techniques, stunnel, etc.)<\/li>\n<li>There are other methods that could be used to copy a file from one system to another in a batch mode that are secure. (e.g via ssh)<\/li>\n<li>I\u2019m using a RedHat and SLES system here. I used \u2018nc\u2019 on RedHat (nc v1.84) and \u2018netcat\u2019 on SUSE (netcat v1.10). I didn\u2019t spent any time investigating versions or differences.<\/li>\n<li>There are a few different timeout options that look interesting depending on your scenario.<\/li>\n<\/ul>\n<p><strong>What we&#8217;re Building<\/strong><\/p>\n<p>In this common log shipping and log analysis scenario, I have a WebSphere Application Server (WAS) on a remote system and it\u2019s writing to a SystemOut.log file in a common location. I want to stream the log records from that WAS SystemOut log to the SCALA server for indexing enabling search and custom app visualization.<\/p>\n<a href=\"http:\/\/dougmcclure.net\/blog\/wp-content\/uploads\/2013\/10\/SendingLogsToSCALAwithNetCat.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/dougmcclure.net\/blog\/wp-content\/uploads\/2013\/10\/SendingLogsToSCALAwithNetCat.png\" alt=\"SendingLogsToSCALAwithNetCat\" width=\"823\" height=\"269\" class=\"aligncenter size-full wp-image-2999\" srcset=\"https:\/\/dougmcclure.net\/blog\/wp-content\/uploads\/2013\/10\/SendingLogsToSCALAwithNetCat.png 823w, https:\/\/dougmcclure.net\/blog\/wp-content\/uploads\/2013\/10\/SendingLogsToSCALAwithNetCat-300x98.png 300w\" sizes=\"auto, (max-width: 823px) 100vw, 823px\" \/><\/a>\n<p><strong>Getting Started<\/strong><\/p>\n<p>Verify that you have netcat installed on each system. Simply type \u2018netcat\u2019 or \u2018nc\u2019 to get a response. If not, find a suitable netcat|nc package for your OS.<\/p>\n<p><strong>SCALA System Side<\/strong><\/p>\n<p>On the SCALA server side we\u2019re using netcat in a listener mode on a specified port. We start netcat in listen mode by using the \u2013l option. Also in this case, we\u2019re going to start \u2018nc\u2019 using the \u2013d option so we can send the command to the background and ignore anything on STDIN. Remember, the port in use needs to be higher than 1024.<\/p>\n<p>The power of netcat comes next when we redirect the output received from listening on the specified port and write that to a file on the SCALA system. In this case, we\u2019re conveniently creating and writing to the log in the [SCALAHOME]\/logsources\/WASInsightPack\/ directory so it\u2019s automatically picked up by the local SCALA LFA and indexed by SCALA.<\/p>\n<p>The command we\u2019ll execute looks like this: (change to fit your environment)<\/p>\n<p><em><strong>nc \u2013dl 1235 > \/opt\/scala\/driver\/logsources\/WASInsightPack\/SystemOut-165.log &#038;<\/strong><\/em><\/p>\n<p><strong>Remote System Side<\/strong><\/p>\n<p>One the remote system, identify the log file of interest. In our case, we\u2019re using the standard SystemOut.log for the WAS server. On this system we\u2019re going to execute the tail \u2013F command on that file and pipe it into the \u2018nc\u2019 command for sending over the network. We use the \u2013F flag for tail so it follows any logfile that gets rolled over.  You could just as easy use \u2018cat\u2019 to send the entire logfile over at that point in time.<\/p>\n<p>This command is piped into the netcat command \u2018nc\u2019. We\u2019re specifying the remote SCALA v1102 system IP address 10.10.10.1 and the port we\u2019ll be using in the netcat command issued on the SCALA server as 1235. We\u2019ll send this to the background so it runs all the time. We are tailing a file after all!<\/p>\n<p>The command we\u2019ll execute looks like this: (change to fit your environment)<\/p>\n<p><em><strong>tail -F \/opt\/IBM\/WebSphere\/AppServer\/profiles\/AppSrv01\/logs\/TradeServer2\/SystemOut.log | nc 10.10.10.1 1235 &#038;<\/strong><\/em><\/p>\n<p><strong>Creating a SCALA Logsource<\/strong><\/p>\n<p>Before we start up our netcat connections, let\u2019s get a new SCALA log source defined so we\u2019re ready for indexing from the start. Within the SCALA Administrative GUI, create a new logsource for the file. As we\u2019re running netcat on the SCALA server, we\u2019ll just use the local SCALA hostname and the full path and log file name in our log source definition. In our case we\u2019ll use the standard WebSphere SystemOut source type and collection, but you\u2019ll need to choose the appropriate ones for your log type.<\/p>\n<p><strong>Starting up Netcat<\/strong><\/p>\n<p>Start the netcat listener on the SCALA server first:<\/p>\n<p><em><strong>nc \u2013dl 1235 > \/opt\/scala\/driver\/logsources\/WASInsightPack\/SystemOut-165.log &#038;<\/strong><\/em><\/p>\n<p>Next, start the netcat client on the remote system:<\/p>\n<p><em><strong>tail -F \/opt\/IBM\/WebSphere\/AppServer\/profiles\/AppSrv01\/logs\/TradeServer2\/SystemOut.log | nc 10.10.10.1 1235 &#038;<\/strong><\/em><\/p>\n<p>To verify things are working, tail the file you\u2019re creating on the SCALA server side as well as run some queries in the SCALA GUI for the log source you created.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve been working on our big demo for the upcoming IOD Big Data and Analytics conference in November where we&#8217;ll highlight our Smart Cloud Analytics portfolio and ran into what&#8217;s likely a common challenge in many client environments. We include the right to use the IBM Tivoli Log File Agent (LFA) and I was happily [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[869,880,895,867,856,879],"tags":[886,899,891,898,900],"class_list":{"0":"post-2998","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-analytics-2","7":"category-application-analytics","8":"category-event-analytics","9":"category-ibm-log-analytics","10":"category-log-analytics","11":"category-smart-cloud-analytics","12":"tag-loganalytics","13":"tag-logfile","14":"tag-logshipping","15":"tag-netcat","16":"tag-scala"},"_links":{"self":[{"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/posts\/2998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/comments?post=2998"}],"version-history":[{"count":5,"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/posts\/2998\/revisions"}],"predecessor-version":[{"id":3004,"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/posts\/2998\/revisions\/3004"}],"wp:attachment":[{"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/media?parent=2998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/categories?post=2998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dougmcclure.net\/blog\/wp-json\/wp\/v2\/tags?post=2998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}