Collect logs from Apache with the Ops Agent
Learn how to collect and view syslog
logs collected from an
Apache web server installed on a Compute Engine virtual machine (VM) instance
by using the Ops Agent. You can
use a process similar to the one in this quickstart to
monitor other third-party applications.
In this quickstart, you do the following:
- Create a Compute Engine VM instance and install the Ops Agent.
- Install an Apache web server.
- Configure the Ops Agent for the Apache web server.
- View your logs in the Logs Explorer.
- Create a log-based alert.
- Test your alert.
- Clean up.
To follow step-by-step guidance for this task directly in the Google Cloud console, click Guide me:
Before you begin
-
Security constraints defined by your organization might prevent you from completing the following steps. For troubleshooting information, see Develop applications in a constrained Google Cloud environment.
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the Compute Engine, Cloud Monitoring, and Cloud Logging APIs.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the Compute Engine, Cloud Monitoring, and Cloud Logging APIs.
Create a VM instance
-
In the Google Cloud console, go to the VM instances page:
If you use the search bar to find this page, then select the result whose subheading is Compute Engine.
Create a VM by clicking Create instance.
- In the
Name field, enter a descriptive name. - In the
Machine type field, select e2-small. - In the
Boot disk section, keep the default setting of Debian GNU/Linux. - In the
Firewall section, select both Allow HTTP traffic and Allow HTTPS traffic. - In the Observability - Ops Agent section, select Install Ops Agent for Monitoring and Logging.
- Click
Create .
Install an Apache web server
To install an Apache web server on your Compute Engine VM instance, do the following:
On the VM instances page, locate your new VM, go to the Connect column, and then click SSH.
Having trouble connecting? Refer to Troubleshooting SSH.
To update the package lists, copy the following command to your clipboard, paste the command into the SSH terminal, and then press enter:
sudo apt-get update
After you see the message "Reading package lists... Done", in the SSH terminal, run the following command to install an Apache2 web server:
sudo apt-get install apache2 php7.0
When asked to continue the installation, enter
Y
. If the install command fails, then usesudo apt-get install apache2 php
.When your command prompt returns, go to the VM instances page and copy the VM's external IP address into the following URL:
http://EXTERNAL_IP
To connect to your Apache web server, open a new browser tab, and then enter the URL from the previous step.
When the web server is successfully installed, the browser tab displays the Apache2 Debian default page.
Collect Apache web server logs and metrics
In these steps, you configure the Ops Agent to collect logs and metrics from your Apache web server:Go to the SSH terminal for your VM instance. If you don't have a terminal open, then do the following:
-
In the Google Cloud console, go to the VM instances page:
If you use the search bar to find this page, then select the result whose subheading is Compute Engine.
- Locate your new VM and then click SSH.
-
Copy the following command, then paste it into the terminal for your instance, and then press enter:
The previous command creates the configuration to collect and ingest logs and metrics from the Apache web server. For more information, see Configure the Ops Agent for Apache web server.
- Wait until the command prompt is shown, which takes at least 60 seconds.
View Apache web server logs
To view your logs in the Google Cloud console, use the Logs Explorer:
-
In the Google Cloud console, go to the Logs Explorer page:
If you use the search bar to find this page, then select the result whose subheading is Logging.
Your most recent logs are displayed in the Query results pane.
In the toolbar, ensure that Show query is enabled.
To view your Apache web server logs, create and run a query:
Expand the list of Google Cloud projects from the Google Cloud project selector, and then copy the Google Cloud project ID into your clipboard.
In the following expression, paste the copied ID into the PROJECT_ID field, and then copy the expression into the query editor:
resource.type="gce_instance" logName=("projects/PROJECT_ID/logs/apache_access" OR "projects/PROJECT_ID/logs/apache_error")
When the previous query is run, only
apache_access
andapache_error
log entries are shown.Click
Run query .The results of the query are displayed in the Query results pane.
You've configured the Ops Agent to collect logs and metrics from your Apache web server, and you've viewed those logs. The next step is to create an alerting policy so that you're notified when a specific pattern appears in a log.
Create an email notification channel
Before you create an alerting policy, configure the notification channels that you want the alerting policy to use. Cloud Monitoring supports many different types of notification channels, including email, Slack, PagerDuty, and Pub/Sub. For more information, see Create and manage notification channels. To get notifications by e-mail, do the following:-
In the Google Cloud console, go to the notifications Alerting page:
If you use the search bar to find this page, then select the result whose subheading is Monitoring.
- In the toolbar, click Edit Notification Channels.
- On the Notification channels page, scroll to
Email , and then click Add new. - Enter your email address, a display name such as
My email
, and then click Save.
Create a log-based alert
To be notified when a specific message appears in your log entries, create a
log-based alert. In this section, you create a log-based alert so that you are
notified when a 404 Not Found
message appears in your log entries.
-
In the Google Cloud console, go to the Logs Explorer page:
If you use the search bar to find this page, then select the result whose subheading is Logging.
In the Query results toolbar, click add_alert Create alert. The log-based alert policy pane opens.
In Alert details, for the Alert Policy Name field, enter
404 Not Found
.In Choose logs to include in this alert, do the following:
- Remove any content that is in the log filter text box.
Copy the following query and paste it into the log filter text box:
severity>=DEFAULT /help httpRequest.status=404
The previous log filter searches for log entries with a
severity
level of at leastDEFAULT
, that contain the text/help
, and that contain anhttpRequest
status of404
.
In Set notification frequency and autoclose duration section, do the following:
- Set the Time between notifications field to 5 min.
- Set the Incident autoclose duration field to 30 min.
In Who should be notified?, select your email from Notification Channels menu, and then click Save.
Test the alerting policy
To test the alerting policy, do the following:
Go to the SSH terminal for your VM instance. If you don't have a terminal open, then do the following:
-
In the Google Cloud console, go to the VM instances page:
If you use the search bar to find this page, then select the result whose subheading is Compute Engine.
- Locate your new VM and then click SSH.
-
To search the server for the fake page
localhost/help
, run the following command:curl localhost/help
After you see a
404 Not Found
message in the terminal, an email notification is sent. It takes several minutes for this process to complete.The email notification you receive looks similar to the following:
To view the new log entries, do the following:
-
In the Google Cloud console, go to the Logs Explorer page:
If you use the search bar to find this page, then select the result whose subheading is Logging.
- In the toolbar, click Jump to now.
-
You've configured the Ops Agent to collect logs and metrics from your Apache web server, but you've only viewed logs. For information about how to view Apache web server metrics, see Collect Apache web server metrics with the Ops Agent: Generate traffic.
Clean up
To avoid incurring charges to your Google Cloud account for the resources used on this page, follow these steps.
If you created a new project and you no longer need the project, then delete the project.
If you used an existing project, then do the following:
If you created a VM, then delete it:
- In the Google Cloud console, go to the VM instances page.
- Select the checkbox for the instance that you want to delete.
- To delete the instance, click More actions, click Delete, and then follow the instructions.
Delete the alerting policy that you created:
-
In the Google Cloud console, go to the notifications Alerting page:
If you use the search bar to find this page, then select the result whose subheading is Monitoring.
- Select the alerting policy that you created, and then click
Delete .
-
What's next
To learn about the Ops Agent and supported integrations, see:
For information about viewing logs in the Logs Explorer, see View logs by using the Logs Explorer.
For information about querying in the Logs Explorer, see Build queries in the Logs Explorer.
For information about how to collect and view Apache web server metrics, see the quickstart Collect Apache web server metrics with the Ops Agent.
For more information about Monitoring and its relation to Cloud Logging, see Monitoring.