3

I have an application which writes its own log file in /var/log/app/app.log. How can I forward these logs to a remote Rsyslog server?

3

You can do this with the imfile module.

On the sending server's rsyslog config;

$ModLoad imfile
$InputFileName /var/log/app/app.log
$InputFileTag tag_app_log:
$InputFileStateFile app_log1
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor

# Send over TCP
local7.*                                @@remoteserver
# Send over UDP
local7.*                                @remoteserver

On the receiving server's rsyslog config;

$template YourApp, "/path/to/yourlogs/app/app.log"
local7.*                                -?YourApp
  • You've not made any reference on how to actually forward the logs over TCP or UDP. Don't use TCP with imfile and rsyslog, however. I've seen some very dodgy behavior if the remote end goes away (for whatever reason). – Tom O'Connor Jul 10 '13 at 15:15
  • You're right. I rushed to get this answered on my way out yesterday. I'll edit to include that bit. I included both methods, since any issue with rsyslog/tcp/and imfile should be submitted as a bug report. It's not unsupported so there should be an expectation for it to work. Additionally, you may want to configure local queuing and RELP for guaranteed delivery. (Outside the scope of the question.) – Aaron Copley Jul 10 '13 at 15:36
  • Thank you very much for your help. This has gotten me halfway. For some reason logs from app.log are not being sent (tcpdump reports no traffic) but daemon specific traffic is. I opened another question on security stack-exchange with the specific application and where I am at the moment: security.stackexchange.com/questions/38709/…. Could you lend me a hand? Cheers – user2284355 Jul 10 '13 at 16:57
  • 1
    The daemon messages are probably covered by the *.* rule on the sender. You need to focus on the configuration above. What version of rsyslog and on what distribution? This is generic for Red Hat 6, rsyslog 5.8.x which is what I have notes for in front of me. – Aaron Copley Jul 10 '13 at 17:13
  • 1
    Using: logger -t honeyd "my little pony" correctly logs the string "my little pony" into /var/log/honeyd.log on my receiving server. – user2284355 Jul 10 '13 at 17:39
1

You can use syslog-ng to forward the logs.

source s_all {
internal();
unix-stream("/dev/log");
file("/path/to/your/file" follow_freq(1) flags(no-parse));
};
destination d_remotelogger {
udp("192.168.254.254" port(5514));
};
log {
source(s_all); destination(d_remotelogger);
};
0

If the log does not support [r]syslog, create an nfs export on the remote server to hold the log, and moun the export on your app server at /var/log/app .

0

You can use filelogger which does not require you install and configure rsyslog or other syslog software on your localhost.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.