I have several servers (Linux, various distributions managed by different people) which logs I would like to centralize in splunk>. The logs are gathered in
/var/logs but the sources either update them directly (Apache for instance) or via
rsyslog. In other words I can assume that the logs will be in on place but the way they appear there is not that defined (and changes between servers).
I am therefore looking for a way to handle
/var/logs as a whole by generating a daily delta which I would then send to splunk>. I can write a script which would do such things (parse the tree, gather the files, add to an archive, zero them, etc.) but I am sure this problem has already be resolved in a better way (something along the lines of
logrotate but for a whole directory)
(Note: following up on comments I want to stress the fact that I do not have control nor knowledge about the files which will be created in
/var/log. Specifically I do not want to rely on solutions which require me to configure the handlong log file by log file)