[SOLVED] rsyslog forwarding new messages only

saeeddeep · 05-23-2021, 09:02 AM

hello

Configuring rsyslog on Centos 7 to forward logs to a centralized syslog server.

rsyslog forwards new log lines fine as expected. But the old existing lines in /var/log/messages are not forwarded. I see this is the normal behavior, only new lines will be forwarded.

Any way I can forward all existing lines from /var/log/messages ?

TB0ne · 05-23-2021, 09:47 AM

Quote:

Originally Posted by saeeddeep

hello
Configuring rsyslog on Centos 7 to forward logs to a centralized syslog server.

rsyslog forwards new log lines fine as expected. But the old existing lines in /var/log/messages are not forwarded. I see this is the normal behavior, only new lines will be forwarded. Any way I can forward all existing lines from /var/log/messages ?

Is there a reason you need those lines? If it's only about archiving purposes, you can just copy the file to the central syslog server and be done.

Alternatively, you can use either the logger command, or even something like:

Code:

cat <FILE NAME> | nc -4u -w1 <SYSLOG HOST> <SYSLOG PORT>

Have you searched for any solutions on your own? After thirteen years, you should know to do basic research first.

saeeddeep · 05-23-2021, 10:30 AM

yes, forwarding all content of /var/log/messages to rsyslog server is required.
cat file | nc .. before start forwarding logs solved this requirement. thanks TB0ne

TB0ne · 05-23-2021, 11:02 AM

Quote:

Originally Posted by saeeddeep

yes, forwarding all content of /var/log/messages to rsyslog server is required.
cat file | nc .. before start forwarding logs solved this requirement. thanks TB0ne

Why was it 'required', and why wouldn't just copying/appending the file fit the 'requirement'?? And again, please do basic research first per the "Question Guidelines".