Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an application which writes its own log file in /var/log/app/app.log. How can I forward these logs to a remote Rsyslog server?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

You can do this with the imfile module.

On the sending server's rsyslog config;

$ModLoad imfile
$InputFileName /var/log/app/app.log
$InputFileTag tag_app_log:
$InputFileStateFile app_log1
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor

# Send over TCP
local7.*                                @@remoteserver
# Send over UDP
local7.*                                @remoteserver

On the receiving server's rsyslog config;

$template YourApp, "/path/to/yourlogs/app/app.log"
local7.*                                -?YourApp
share|improve this answer
    
You've not made any reference on how to actually forward the logs over TCP or UDP. Don't use TCP with imfile and rsyslog, however. I've seen some very dodgy behavior if the remote end goes away (for whatever reason). –  Tom O'Connor Jul 10 '13 at 15:15
    
You're right. I rushed to get this answered on my way out yesterday. I'll edit to include that bit. I included both methods, since any issue with rsyslog/tcp/and imfile should be submitted as a bug report. It's not unsupported so there should be an expectation for it to work. Additionally, you may want to configure local queuing and RELP for guaranteed delivery. (Outside the scope of the question.) –  Aaron Copley Jul 10 '13 at 15:36
    
Thank you very much for your help. This has gotten me halfway. For some reason logs from app.log are not being sent (tcpdump reports no traffic) but daemon specific traffic is. I opened another question on security stack-exchange with the specific application and where I am at the moment: security.stackexchange.com/questions/38709/…. Could you lend me a hand? Cheers –  user2284355 Jul 10 '13 at 16:57
    
The daemon messages are probably covered by the *.* rule on the sender. You need to focus on the configuration above. What version of rsyslog and on what distribution? This is generic for Red Hat 6, rsyslog 5.8.x which is what I have notes for in front of me. –  Aaron Copley Jul 10 '13 at 17:13
1  
Using: logger -t honeyd "my little pony" correctly logs the string "my little pony" into /var/log/honeyd.log on my receiving server. –  user2284355 Jul 10 '13 at 17:39

You can use syslog-ng to forward the logs.

source s_all {
internal();
unix-stream("/dev/log");
file("/path/to/your/file" follow_freq(1) flags(no-parse));
};
destination d_remotelogger {
udp("192.168.254.254" port(5514));
};
log {
source(s_all); destination(d_remotelogger);
};
share|improve this answer
    
That was a VERY generous edit, Tom. :) –  Aaron Copley Jul 10 '13 at 15:50
    
Eh, it was missing the vital bits. –  Tom O'Connor Jul 11 '13 at 8:05

If the log does not support [r]syslog, create an nfs export on the remote server to hold the log, and moun the export on your app server at /var/log/app .

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.