Hi All,

I have configured rsyslog server on one of the CentOS machines.

I am trying to monitor Squid service running on a Ubuntu box using this CentOS machine.

Can we edit the syslog to just send squid service failure alerts to a remote syslog server ?

I have googled around but did not find much.

Regards,

Sure, plenty of hits out there.... http://wiki.rsyslog.com/index.php/Fi...y_program_name will get your squid messages separate (although note you can probably use it's facility value directly, it's possibly unique within your system) and then sending it on is a doddle - http://rsyslog.com/storing-and-forwa...mote-messages/

Also note that from squid 2.7 squid can apparently directly send UDP syslog messages to the network, bypassing the system syslog completely if desired.

1 members found this post helpful.

Hi,

Thanks for the reply. I will Certainly try it out.

Eventually I am receiving the Squid alerts on the rsyslog server. But the thing is it is capturing every service. I wanted to filter that.

Majority of our Ubuntu boxes are being squid servers and not much other services are running on them, so If I can get all the messages that is in a way not too much.

And while i was going through the rsyslog, I came across a module ommail where it can send emails based on rules.

When I added that to the rsyslog.conf, it gave error. though the service started, the module didn't load.

This module ommail is to be separately installed?

If I can set up mail notification based on Squid service failures, then there is nothing like it!.

Thanks again for your reply.

Regards,

This issue is solved.

I upgraded the CentOS, rsyslog4.6 version has ommail inbuit and it is working.

Regards,