-   Linux - Enterprise (
-   -   Configuring more than one custom file in syslog (

carpannav 11-03-2015 08:47 AM

Configuring more than one custom file in syslog

I've been asked to setup syslog to forward custom log files (different from /var/log/*) to a network machine.
After some googling found the solution for one file, using the next paragraph in /etc/rsyslog.conf:

$ModLoad imfile
$InputFileName /var/log/vco/app-server/warning.log
$InputFileTag vco-warning
$InputFileStateFile stat-vco-warning
$InputFileSeverity warning
$InputFileFacility local3
local3.* @@

But if I try to configure another file (like you can see below), the first stops working and only the second one is forwarded.

$InputFileName /var/log/vco/app-server/catalina.out
$InputFileTag vco-catalina
$InputFileStateFile stat-vco-catalina
$InputFileSeverity warning
$InputFileFacility local4
local4.* @@

Does anyone know how to enable forwarding for more than one custom file to a remote syslog?

Thank you so much!

Habitual 11-04-2015 01:26 PM

Here's a 'watchfile' I have from my Archived notes.
It forwards 2 files.

### edit /etc/rsyslog.d/10-watchfile.conf

# apache error.log
$InputFileName /var/log/apache2/error.log
$InputFileTag apache-errors:
$InputFileStateFile state_file_error_apache
$InputFileFacility local6
$InputFileSeverity info
$InputFilePollInterval 10

# apache access.log
$InputFileName /var/log/apache2/access.log
$InputFileTag apache-access:
$InputFileStateFile state_file_access_apache
$InputFileFacility local6
$InputFileSeverity info
$InputFilePollInterval 10

if $programname == 'apache-access' then
& stop
if $programname == 'apache-errors' then
& stop

I abandoned this arrangement in favor of logstash-forwarder.
Hope this is useful for you.

carpannav 11-06-2015 05:32 AM

It's working now.

I made one mistake. If you put it in the main file it doesn't work. Needs to be in a separate file in /etc/rsyslog.d !!

Thanks Habitual!!! ;)

Habitual 11-06-2015 08:38 AM

Rock on. Glad it worked out.
And Welcome to LQ!

All times are GMT -5. The time now is 07:34 AM.