This Guide Provides Basic Information About the Logging Agent, an Application Based on Uentd

1/25/2020 About the Logging agent | Stackdriver Logging | Google Cloud

This guide provides basic information about the Logging agent, an application based on uentd (http://www.uentd.org/) that runs on your virtual machine (VM) instances.

In its default conguration, the Logging agent streams logs from common third-party applications and system software to Logging; see the list of default logs (/logging/docs/agent/default-logs). You can congure the agent to stream additional logs; see Conguring the Logging agent (/logging/docs/agent/conguration) for details on agent conguration and operation.

It is a best practice to run the Logging agent on all your VM instances. The agent runs under both Linux and Windows. To install the Logging agent, see Installing the agent (/logging/docs/agent/installation).

https://cloud.google.com/logging/docs/agent/ 1/5 1/25/2020 About the Logging agent | Stackdriver Logging | Google Cloud

You can run the Logging agent on the following operating systems on compatible virtual machine (VM) instances:

CentOS 6, 7, and 8

Debian 9 "Stretch" and 10 "Buster"

Red Hat Enterprise Linux 6, 7, and 8

Ubuntu LTS 16.04 "Xenial", LTS 18.04 "Bionic", and 19.04 "Disco"

Ubuntu Minimal LTS 16.04 "Xenial", LTS 18.04 "Bionic"

SUSE Linux Enterprise Server 12 SP3, 12 SP2 for SAP, 12 SP3 for SAP, 15, 15 for SAP, and 15 SP1 for SAP

Windows Server 2008 R2, 2012 R2, 2016, and 2019

Amazon Linux AMI (except Amazon Linux 2.0 AMI)

The Logging agent is compatible with the following environments:

Compute Engine (/compute) instances. The Logging agent sends the logs to the project associated with each VM instance.

For instances without external IP addresses, you must enable Private Google Access (/compute/docs/private-google-access/congure-private-google-access) to allow the Logging agent to send logs.

Amazon Web Services Elastic Compute Cloud (AWS EC2) (http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html) instances. The Logging agent sends the logs to the AWS connector project (/monitoring/accounts#account-project) for your Workspace. Stackdriver creates this project for you when you connect your AWS account to a Workspace.

For the Logging agent to function correctly, the Amazon EC2 instance it runs on must be able to communicate with Google Cloud APIs, particularly the Logging API. This requires either an external IP address or a VPC internet gateway (http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html).

The standard Logging agent is not supported on on-premise machines. However, GKE On-Prem comes with a version ent already installed and ready to use.

https://cloud.google.com/logging/docs/agent/ 2/5 1/25/2020 About the Logging agent | Stackdriver Logging | Google Cloud

For these VM instances, a minimum of 250 MiB of resident (RSS) memory is required to run the Logging agent, but 1 GiB is recommended. For example, at a rate of 100 1-KB-sized log entries per second, the Logging agent with default congurations consumes 5% CPU on one core and 150 MiB memory. At a peak rate of 3,000 1-KB-sized log entries per second, the Logging agent, uses 80% CPU on one core and 250 MiB memory.

The following VM instances support Logging using their own software, so manually installing the Logging agent on them is not supported:

App Engine (/appengine/) standard environment instances. App Engine includes built-in support for Logging. For more information, go to Writing application logs (/appengine/docs/standard/python3/writing-application-logs).

App Engine (/appengine/) exible environment instances. Apps running in the App Engine exible environment can write logs that are in addition to what is included in the App Engine standard environment. For more information, go to Writing application logs (/appengine/docs/exible/python/writing-application-logs).

Google Kubernetes Engine (/kubernetes-engine/docs) node instances. You can enable Stackdriver Kubernetes Engine Monitoring (/monitoring/kubernetes-engine/installing), an integrated monitoring and logging solution, for your new or existing container clusters.

For instances running on GKE On-Prem (/gke-on-prem/docs/), the agent collects system logs but doesn't collect application logs.

Cloud Run (/run/docs/) container instances. Cloud Run includes built-in support for Logging. For more information, go to Logging and viewing logs (/run/docs/logging).

Cloud Functions (/functions/docs/) HTTP and background functions. Cloud Functions includes built-in support for Logging. For more information, go to Writing, Viewing, and Responding to Logs (/functions/docs/monitoring/logging).

Stackdriver partners with Blue Medora (https://www.bluemedora.com) to provide logging services for on-premise and hybrid cloud platforms (/logging/docs/blue-medora/on-premise-hybrid-logging) in a consistent and predictable way. Using Blue Medora, you can collect your own data and send it to Logging for analysis. Blue Medora's Bindplane (https://bluemedora.com/products/bindplane/) integrates with Stackdriver Logging to capture data from your infrastructure and is included with your project at no additional cost.

For more information about Blue Medora, see About Blue Medora (/stackdriver/blue-medora).

https://cloud.google.com/logging/docs/agent/ 3/5 1/25/2020 About the Logging agent | Stackdriver Logging | Google Cloud

Running the agent requires access to the following DNS names:

OAuth2 token server: oauth2.googleapis.com

Older versions of the agent may require access to www.googleapis.com (full URL: https://www.googleapis.com/oauth2/v3/token).

If you're using an older version of the agent, it's recommended that you upgrade your agent (/logging/docs/agent/installation#upgrade) to the latest version.

Logging APIs: logging.googleapis.com

Installing the agent requires access to the following DNS names:

(Linux) Google Cloud package repository: packages.cloud.google.com

(Windows) Google download server: dl.google.com

You do not need the information in this section unless you want to understand the source code or you have other special needs. The Logging agent is installed by the script described in the installation instructions (/logging/docs/agent/installation).

The Logging agent, google-fluentd, is a modied version of the uentd (http://www.uentd.org/) log data collector. google-fluentd is distributed in two separate packages. The source code is available from the associated GitHub repositories:

The GitHub repository named google-fluentd (https://github.com/GoogleCloudPlatform/google-uentd) which includes the core fluentd program, the custom packaging scripts, and the output plugin for the Stackdriver Logging API.

The output plugin is packaged as a Ruby gem and is included in the google-fluentd package. It is also available separately at the Ruby gem hosting service at uent-plugin- google-cloud (https://rubygems.org/gems/uent-plugin-google-cloud).

The GitHub repository named google-fluentd-catch-all-config (https://github.com/GoogleCloudPlatform/uentd-catch-all-cong) which includes the conguration les for the Logging agent for ingesting the logs from various third-party software packages.

https://cloud.google.com/logging/docs/agent/ 4/5 1/25/2020 About the Logging agent | Stackdriver Logging | Google Cloud

The Logging agent is subject to the Stackdriver agents deprecation policy (/stackdriver/docs/agent-deprecation-policy).

Installing the Logging agent (/logging/docs/agent/installation)

Conguring the Logging agent (/logging/docs/agent/conguration)

Authorizing the Logging agent (/logging/docs/agent/authorization)

Upgrading the Logging agent (/logging/docs/agent/installation#upgrade)

https://cloud.google.com/logging/docs/agent/ 5/5