Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've setup an rsyslog server which accepts log information from clients.

I can successfully receive syslog messages however I'm interested in logging a number of files too.

Here is what my client looks like:

$ModLoad imfile

$InputFileName /var/log/drew-error.log
$InputFileTag drew:
$InputFileStateFile stat-drew-error
$InputFileSeverity error
$InputRunFileMonitor

$InputFilePollInterval 1

I'm not sure exactly what to put in my server config. Ideally I'd like the server to output something like this:

/var/log/remote/$HOSTNAME/drew-error.log

Am I going about this the right way? Is this reasonable to try to achieve?

Best Case Scenario: I'd like to be able to update the files I'm watching on the client, without having to reconfigure the server. If that's not possible, or too hard, I can probably work around a hard-coded solution.

What I've tried

So far I've tried a few configurations for the server (though I feel they're not the right solution/approach):

$template syslog, "/var/log/remote/%hostname%/%programname%/%$year%%$month%%$day%/syslog"
*.*;auth,authpriv.none          ?syslog

and

$template DrewTemplate,"/var/log/remote-DREWAPP-%HOSTNAME%.log"
if $programname == 'drew:' then -?DrewTemplate
& ~

$template PerHostLog,"/var/log/remote-%HOSTNAME%.log"
if $fromhost-ip startswith '1.2.' then -?PerHostLog
& ~
share|improve this question

1 Answer 1

up vote 1 down vote accepted

One solution is to check the $programname (which gets populated with the value from $InputFileTag on the client for each file you monitor).

Client Configuration

On the client, create your file monitor(s), and make sure $InputFileTag starts with 'file-'. Here is an example with log files foo and bar:

######################### START /var/log/foo.log
$InputFileName /var/log/foo.log
$InputFileTag file-foo:
$InputFileStateFile stat-foo
$InputFileSeverity info
$InputRunFileMonitor
######################### END /var/log/foo.log

######################### START /var/log/bar.log
$InputFileName /var/log/bar.log
$InputFileTag file-bar:
$InputFileStateFile stat-bar
$InputFileSeverity info
$InputRunFileMonitor
######################### END /var/log/bar.log

Server Configuration

And then on the server, check that $programname starts with 'file-' (as should be the case for all of your file monitors, but not for any of the standard syslog messages). Here is an example:

$template FileTemplate,"/var/log/remote-%HOSTNAME%-%programname%.log"
if $programname startswith 'file-' then -?FileTemplate
& ~
  • This solution checks to see if the $programname starts with 'file-'
  • As long as you have control over how you label $InputFileTag (on the client) this solution works quite well
  • The template uses programname and hostname to keep file names unique on the server
  • The & ~ makes sure this syslog message doesn't get processed further down in the config
  • This solution provides ONE configuration on the server that doesn't need to be updated each time you add a new file monitor on the client.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.