Skip to content

Fluentd Reference

td-agent was discontinued in December 2023 and has been replaced by fluent-package. The fluent-package is the official successor maintained by the Cloud Native Computing Foundation.

The following files are installed by the rpm or Debian packages.

fluent-package 6.x

ResourceLocationNotes
Config Directory/etc/fluent/
Config File/etc/fluent/fluentd.confThis config will be picked-up by the startup script
Startup Script/usr/lib/systemd/system/fluentd.service
Log Directory/var/log/fluent/
Plugin Directory/etc/fluent/plugin/Your custom plugins go here.
Ruby Interpreter/opt/fluent/bin/rubyRuby is bundled with the package.
Rubygems/opt/fluent/bin/fluent-gemBundled rubygems to install fluentd plugins. For example: fluent-gem install fluent-plugin-mongo
jemalloc/opt/fluent/lib/libjemalloc.sojemalloc is bundled together to avoid memory fragmentation. It is loaded by default in the startup script.

Supervision, Privileges and Network Ports

When Fluentd starts, it launches 2 processes: parent and child. The parent process is managing the life cycle of the child process, and the child process handles actual log collection.

$ ps w -C ruby -C fluentd --no-heading
26238 ? Sl 0:00 /opt/fluent/bin/ruby /opt/fluent/bin/fluentd --config /etc/fluent/fluentd.conf --log /var/log/fluent/fluentd.log
26243 ? Sl 0:25 /opt/fluent/bin/ruby /opt/fluent/bin/fluentd --config /etc/fluent/fluentd.conf --log /var/log/fluent/fluentd.log --under-supervisor

Both processes run as the fluentd user under fluentd group and all forked subprocesses run as the same. This applies to any system call initiated by Fluentd as well. The agent configuration resides at /etc/fluent/fluentd.conf. All configurations must be readable by the fluentd user.

The following ports are open depending on your input.

  • in_tail: nothing
  • in_forward: tcp/24224, udp/24224
  • in_unix: /var/run/fluent/fluentd.sock

For secure uploading to Treasure Data, you must open tcp/443 (https) for *.treasuredata.com.

Other Resources