LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 07-31-2018, 06:05 PM   #1
nicedreams
Member
 
Registered: Jun 2003
Location: Phoenix, AZ
Posts: 112

Rep: Reputation: 17
rsyslogd and rsync logs


My goal is to have /var/log/rsync.log from other client computers at remote sites sent to master log server so I know if backups are working properly or not.

I setup rsyslog server on a linux server and setup another linux client to send logs to server for testing. It's working with the default rsyslog.conf setup which is pretty simple, but for the past couple days been trying to figure out how to get logs from rsync sent from client to rsyslogd server.

I figured out how to make rsyslog send the rsync.log file from client to server, but only if I put dummy information in the log (copied some text from auth log into rsync.log for testing). I don't think rsyslog likes the date formatting that rsync does when using --log-file=/var/log/rsync.log because it won't send the file this way.


### /etc/rsyslog.conf - On Client Computer
module(load="imfile" PollingInterval="10")
# File 1
input(type="imfile"
File="/var/log/rsync.log"
Tag="rsync-log")

##############################

### syslog formatting (most files I've viewed)
Jul 30 17:37:57 testhost sshd[30376]: Connection closed by

### rsync log formatting using --log-file=/var/log/rsync.log
2018/07/31 15:17:39 [27121] total size is 65 speedup is 0.16


After reading a bunch of documentation I'm not understanding properly it seems I need to make a template so rsyslog knows how to see the rsync.log date formatting? Or figure out a way to have rsync match the format rsyslog likes.

Was hoping someone could create this template for me since I'm lost so I can understand it and modify it for other custom log files I may have in the future. I've tried making a template, but I think I'm blindly typing stuff now hoping it works. Or whatever the fix is.
 
Old 09-25-2018, 11:05 AM   #2
nicedreams
Member
 
Registered: Jun 2003
Location: Phoenix, AZ
Posts: 112

Original Poster
Rep: Reputation: 17
Well didn't find the exact answer, but I found and started using "logger" which can send messages to syslog via command line. So I setup successful and failed rsync events to be sent over syslog with logger so at least I know status of fail or not.

This site helped me with this:
https://www.cyberciti.biz/tips/howto...to-syslog.html
 
Old 09-26-2018, 07:53 PM   #3
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
Quote:
Originally Posted by nicedreams View Post
Code:
### /etc/rsyslog.conf - On Client Computer
module(load="imfile" PollingInterval="10")
# File 1
input(type="imfile"
      File="/var/log/rsync.log"
      Tag="rsync-log")

##############################
here's mine from the client
Code:
cat /etc/rsyslog.conf
### /etc/rsyslog.conf
### rsyslogd 7.6.6 on Ubuntu 12.04.5 LTS


### Debugging ###
#syslog.* /var/log/syslog.debug;RSYSLOG_DebugFormat
#$DebugFile /var/log/syslog.debug
#$DebugLevel 2

$ModLoad imuxsock
$ModLoad imklog
$ModLoad imfile

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on

# Set the default permissions for all log files.
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup adm

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

### Send to monitoring.domain.com
action(type="omfwd" target="nnn.nn.nn.nnn" port="514" protocol="tcp")
*.* @nnn.nn.nn.nnn:514
https://www.linuxquestions.org/quest...2/#post5266672
and
http://[COLOR="Red"]https://www.linu...3/#post5444668 /etc/rsyslog.d/10-watchfile.conf

and Monitoring tomcat6 access log with logwatch

between the /etc/rsyslog.conf and those 2 rsyslog posts, you should make some headway.
The logwatch is just another way to not blindly type random "suicide notes" into your system trying to make rsyslog "work".

Let us know!
John out.

Last edited by Habitual; 09-26-2018 at 07:56 PM.
 
Old 10-03-2018, 02:36 PM   #4
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
What happened here?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] CentOS 7 rsyslogd not accepting logs from client machines dcsst28 Linux - Server 2 01-16-2015 10:48 PM
Back up logs file and create a script showing the backed up logs and the running logs Billy_6052 Programming 5 12-13-2014 02:32 AM
rsyslogd crashes while running as rsyslogd(rsyslogd -M /lib/rsyslog running well) vipul prajapati Linux - Server 1 03-22-2014 03:02 AM
Tweaking rsync logs jwonnacott Linux - Software 3 06-11-2013 04:28 AM
rsyslogd configuration wayloud Linux - Server 2 10-14-2008 02:33 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 06:29 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration