td-agent was discontinued in December 2023 and has been replaced by fluent-package. The fluent-package is the official successor maintained by the Cloud Native Computing Foundation.
The following files are installed by the rpm or Debian packages.
| Resource | Location | Notes |
|---|---|---|
| Config Directory | /etc/fluent/ | |
| Config File | /etc/fluent/fluentd.conf | This config will be picked-up by the startup script |
| Startup Script | /usr/lib/systemd/system/fluentd.service | |
| Log Directory | /var/log/fluent/ | |
| Plugin Directory | /etc/fluent/plugin/ | Your custom plugins go here. |
| Ruby Interpreter | /opt/fluent/bin/ruby | Ruby is bundled with the package. |
| Rubygems | /opt/fluent/bin/fluent-gem | Bundled rubygems to install fluentd plugins. For example: fluent-gem install fluent-plugin-mongo |
| jemalloc | /opt/fluent/lib/libjemalloc.so | jemalloc is bundled together to avoid memory fragmentation. It is loaded by default in the startup script. |
When Fluentd starts, it launches 2 processes: parent and child. The parent process is managing the life cycle of the child process, and the child process handles actual log collection.
$ ps w -C ruby -C fluentd --no-heading26238 ? Sl 0:00 /opt/fluent/bin/ruby /opt/fluent/bin/fluentd --config /etc/fluent/fluentd.conf --log /var/log/fluent/fluentd.log
26243 ? Sl 0:25 /opt/fluent/bin/ruby /opt/fluent/bin/fluentd --config /etc/fluent/fluentd.conf --log /var/log/fluent/fluentd.log --under-supervisorBoth processes run as the fluentd user under fluentd group and all forked subprocesses run as the same. This applies to any system call initiated by Fluentd as well. The agent configuration resides at /etc/fluent/fluentd.conf. All configurations must be readable by the fluentd user.
The following ports are open depending on your input.
- in_tail: nothing
- in_forward: tcp/24224, udp/24224
- in_unix:
/var/run/fluent/fluentd.sock
For secure uploading to Treasure Data, you must open tcp/443 (https) for *.treasuredata.com.