Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog:

# Apache access log
input(type="imfile" File="/var/log/misc/blah.log"
Tag="Apache Access Log"


Some issues/questions:

  1. This forwards all the syslog files. How can I specify only certain specific files to get forwarded?
  2. This does not seem to collect any data from the file I defined. I see regular syslog messages popping up in my graylog server, but not that file.
share|improve this question
I think you may need to read a primer on syslog. Syslog doesn't send files, syslog sends messages with both a facility and a priority tag associated with the message. *.* is not a filename, it's saying forward every message from any facility and with any priority. – yoonix May 3 '14 at 4:47

Try this LEGACY rsyslog formatted version:

# Forward apache logs to graylog2 server
$ModLoad imfile # needs to be done just once

$InputFileName /var/log/httpd/access.log
$InputFileTag ApacheAccessLog:
$InputFileStateFile access.log.statefile
$InputFileFacility local4
$InputFileSeverity info

$InputFileName /var/log/httpd/error.log
$InputFileTag ApacheErrorLog:
$InputFileStateFile error.log.statefile
$InputFileFacility local4
$InputFileSeverity error


You can do similar entries for your other log files.

After that, create some extractors on your graylog2 server for the 12514/TCP input. This will give you some fine grain options for graphs etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.