I have an application which writes its own log file in /var/log/app/app.log. How can I forward these logs to a remote Rsyslog server?
Add a comment
|
4 Answers
You can do this with the imfile module.
On the sending server's rsyslog config;
$ModLoad imfile
$InputFileName /var/log/app/app.log
$InputFileTag tag_app_log:
$InputFileStateFile app_log1
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
# Send over TCP
local7.* @@remoteserver
# Send over UDP
local7.* @remoteserver
On the receiving server's rsyslog config;
$template YourApp, "/path/to/yourlogs/app/app.log"
local7.* -?YourApp
answered Jul 9, 2013 at 21:46
-
You've not made any reference on how to actually forward the logs over TCP or UDP. Don't use TCP with imfile and rsyslog, however. I've seen some very dodgy behavior if the remote end goes away (for whatever reason). Jul 10, 2013 at 15:15
-
You're right. I rushed to get this answered on my way out yesterday. I'll edit to include that bit. I included both methods, since any issue with rsyslog/tcp/and imfile should be submitted as a bug report. It's not unsupported so there should be an expectation for it to work. Additionally, you may want to configure local queuing and RELP for guaranteed delivery. (Outside the scope of the question.) Jul 10, 2013 at 15:36
-
Thank you very much for your help. This has gotten me halfway. For some reason logs from app.log are not being sent (tcpdump reports no traffic) but daemon specific traffic is. I opened another question on security stack-exchange with the specific application and where I am at the moment: security.stackexchange.com/questions/38709/…. Could you lend me a hand? Cheers Jul 10, 2013 at 16:57
-
1The daemon messages are probably covered by the
*.*rule on the sender. You need to focus on the configuration above. What version of rsyslog and on what distribution? This is generic for Red Hat 6, rsyslog 5.8.x which is what I have notes for in front of me. Jul 10, 2013 at 17:13 -
1Using: logger -t honeyd "my little pony" correctly logs the string "my little pony" into /var/log/honeyd.log on my receiving server. Jul 10, 2013 at 17:39
You can use syslog-ng to forward the logs.
source s_all {
internal();
unix-stream("/dev/log");
file("/path/to/your/file" follow_freq(1) flags(no-parse));
};
destination d_remotelogger {
udp("192.168.254.254" port(5514));
};
log {
source(s_all); destination(d_remotelogger);
};
answered Jul 10, 2013 at 11:41
If the log does not support [r]syslog, create an nfs export on the remote server to hold the log, and moun the export on your app server at /var/log/app .
answered Jul 9, 2013 at 22:03
You can use filelogger which does not require you install and configure rsyslog or other syslog software on your localhost.
answered Jan 15, 2015 at 23:15
