Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog:

# Apache access log
input(type="imfile" File="/var/log/misc/blah.log"
Tag="Apache Access Log"
StateFile="statefile1")


*.* @@log.ospreyreach.com:12514

Some issues/questions:

  1. This forwards all the syslog files. How can I specify only certain specific files to get forwarded?
  2. This does not seem to collect any data from the file I defined. I see regular syslog messages popping up in my graylog server, but not that file.
share|improve this question
    
I think you may need to read a primer on syslog. Syslog doesn't send files, syslog sends messages with both a facility and a priority tag associated with the message. *.* is not a filename, it's saying forward every message from any facility and with any priority. –  yoonix May 3 '14 at 4:47

1 Answer 1

Try this LEGACY rsyslog formatted version:

# Forward apache logs to graylog2 server
$ModLoad imfile # needs to be done just once

$InputFileName /var/log/httpd/access.log
$InputFileTag ApacheAccessLog:
$InputFileStateFile access.log.statefile
$InputFileFacility local4
$InputFileSeverity info
$InputRunFileMonitor

$InputFileName /var/log/httpd/error.log
$InputFileTag ApacheErrorLog:
$InputFileStateFile error.log.statefile
$InputFileFacility local4
$InputFileSeverity error
$InputRunFileMonitor

local4.*                        @@log.ospreyreach.com:12514

You can do similar entries for your other log files.

After that, create some extractors on your graylog2 server for the 12514/TCP input. This will give you some fine grain options for graphs etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.