How to deploy the LogMonitor agent using sudo (4250079)

How to deploy the LogMonitor agent using sudo

Can sudo be used for Log Monitoring so that permissions do not have to be granted to the foglight OS user on the log files themselves?

The LogMonitor Agent deploys an executable binary to the monitored host. This is typically copied to /tmp on Unix-based systems, but the name is dynamically generated at the moment of deployment.

E.g. /tmp/fglam-FileLogMonitorAgent-fms-FMSServer--254140837-logmonitor

In general log file permissions do not grant read access to normal users.  So either permission must be granted on the files themselves, or sudo access should be granted to the foglight OS user.

In order to use sudo to run this binary, you can set the binary to a fixed path / name. (e.g. "/tmp/logmonitor")

You specify the path to the executable in the Agent Properties:

•    Navigation Panel | Dashboards | Administration | Agents | Agent Status
•    Select the LogMonitor Agent that will monitor this host.
•    Click on Edit -> Edit Properties
•    Click on "Modify the private properties for this agent"
•    Edit (or clone then edit) the "Monitored Hosts" Secondary Property list
•    On the Remote Collector Executable, add the full path and name to the logmonitor executable. (E.g. /tmp/logmonitor)
•    To run the command with sudo, make sure Secure Launcher is also properly specified. (E.g. /usr/bin/sudo)
•    Click "Save Changes"

You do not have to put the binary there manually, as the agent will copy it there whenever the agent starts, and remove it when the agent is stopped.  Note: The path you specify must be writable by the foglight user.
   
Then your Linux admin would need to write a sudo rule for it, so that the user can run it with the sudo command.  If you have already granted sudo access to the foglight user to run other commands (example for the IC agent) then you might not have to do this step.  But if you wanted to add a sudo rule specifically for the Log monitor, you could add something like this to /etc/sudoers:

## Allow foglight user to run /tmp/logmonitor
foglight ALL=(root) NOPASSWD: /tmp/logmonitor

Then stop and restart the log monitor agent.