How to enable copying of selected logs files incrementally to a remote server in real time

glb · 07-16-2017, 07:19 PM

So as per question,

I am thinking rsync over ssh - yet how to tell rsync to do it?

Idea is to copy to a remote server every change in a selected log as it happen.

TheEzekielProject · 07-17-2017, 12:03 AM

I would create a cron job to monitor the file for changes and update your remote copy accordingly. I'm unaware of any event-based scheduler that will do it in real time

syg00 · 07-17-2017, 01:29 AM

Centralised logging is a common requirement. rsyslog, logstash, ... pick your poison depending on need.

scasey · 07-17-2017, 01:45 AM

Sorry, I gotta ask: Why remote? Why not monitor the log file where it is?

Code:

tail -F /full/path/to/log/file

Turbocapitalist · 07-17-2017, 02:13 AM

Quote:

Originally Posted by glb

Idea is to copy to a remote server every change in a selected log as it happen.

In that case, syg00 has suggested centralized logging and I would go with that. Which logging utility is your source system running? Which one do you have on the target system? Which distro, including version, are you on?

If you try rsync for that specific task, there will be a lot of overhead as the files on both machines are read and processed. rsync would be excellent after the log file has been closed and archived.

Habitual · 07-17-2017, 08:52 AM

a 100 solutions.

I like ELK