I've setup an rsyslog server which accepts log information from clients.
I can successfully receive syslog messages however I'm interested in logging a number of files too.
Here is what my client looks like:
$ModLoad imfile $InputFileName /var/log/drew-error.log $InputFileTag drew: $InputFileStateFile stat-drew-error $InputFileSeverity error $InputRunFileMonitor $InputFilePollInterval 1
I'm not sure exactly what to put in my server config. Ideally I'd like the server to output something like this:
Am I going about this the right way? Is this reasonable to try to achieve?
Best Case Scenario: I'd like to be able to update the files I'm watching on the client, without having to reconfigure the server. If that's not possible, or too hard, I can probably work around a hard-coded solution.
What I've tried
So far I've tried a few configurations for the server (though I feel they're not the right solution/approach):
$template syslog, "/var/log/remote/%hostname%/%programname%/%$year%%$month%%$day%/syslog" *.*;auth,authpriv.none ?syslog
$template DrewTemplate,"/var/log/remote-DREWAPP-%HOSTNAME%.log" if $programname == 'drew:' then -?DrewTemplate & ~ $template PerHostLog,"/var/log/remote-%HOSTNAME%.log" if $fromhost-ip startswith '1.2.' then -?PerHostLog & ~