42 lines
1.8 KiB
SYSTEMD
42 lines
1.8 KiB
SYSTEMD
|
[Unit]
|
||
|
|
Description=Buffer OCI L4 relay journals for VictoriaLogs
|
||
|
|
Wants=network-online.target
|
||
|
|
After=network-online.target oci-l4-relay-bootstrap.service
|
||
|
|
ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
|
||
|
|
PartOf=oci-l4-relay-logs.target
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=simple
|
||
|
|
User=oci-l4-relay-logs
|
||
|
|
Group=oci-l4-relay-logs
|
||
|
|
StateDirectory=oci-l4-relay-logs
|
||
|
|
ExecStart=/usr/local/bin/vlagent -httpListenAddr=127.0.0.1:19532 -journald.ignoreFields=__CURSOR,__MONOTONIC_TIMESTAMP,__SEQNUM,__SEQNUM_ID,_AUDIT_LOGINUID,_AUDIT_SESSION,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_MACHINE_ID,_PID,_RUNTIME_SCOPE,_SELINUX_CONTEXT,_SOURCE_REALTIME_TIMESTAMP,_SYSTEMD_CGROUP,_SYSTEMD_INVOCATION_ID,_SYSTEMD_SLICE,_SYSTEMD_USER_SLICE,_SYSTEMD_USER_UNIT,_TRANSPORT,_UID -journald.streamFields=_SYSTEMD_UNIT,_HOSTNAME -memory.allowedBytes=67108864 -remoteWrite.bearerTokenFile=/etc/oci-l4-relay/log-ingest.token -remoteWrite.maxDiskUsagePerURL=536870912 -remoteWrite.rateLimit=1048576 -remoteWrite.tmpDataPath=/var/lib/oci-l4-relay-logs -remoteWrite.url=https://relay-logs.quorate.dev/insert/native
|
||
|
|
Restart=on-failure
|
||
|
|
RestartSec=10s
|
||
|
|
Slice=oci-l4-relay-logs.slice
|
||
|
|
CapabilityBoundingSet=
|
||
|
|
IPAddressDeny=any
|
||
|
|
IPAddressAllow=localhost
|
||
|
|
IPAddressAllow=10.104.40.127
|
||
|
|
LockPersonality=true
|
||
|
|
MemoryDenyWriteExecute=true
|
||
|
|
NoNewPrivileges=true
|
||
|
|
PrivateDevices=true
|
||
|
|
PrivateTmp=true
|
||
|
|
ProtectClock=true
|
||
|
|
ProtectControlGroups=true
|
||
|
|
ProtectHome=true
|
||
|
|
ProtectHostname=true
|
||
|
|
ProtectKernelLogs=true
|
||
|
|
ProtectKernelModules=true
|
||
|
|
ProtectKernelTunables=true
|
||
|
|
ProtectSystem=strict
|
||
|
|
ReadOnlyPaths=/etc/oci-l4-relay/log-ingest.token
|
||
|
|
ReadWritePaths=/var/lib/oci-l4-relay-logs
|
||
|
|
RestrictAddressFamilies=AF_UNIX AF_INET
|
||
|
|
RestrictNamespaces=true
|
||
|
|
RestrictRealtime=true
|
||
|
|
RestrictSUIDSGID=true
|
||
|
|
SystemCallArchitectures=native
|
||
|
|
SystemCallFilter=@system-service
|
||
|
|
UMask=0077
|