I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog:

# Apache access log
input(type="imfile" File="/var/log/misc/blah.log"
Tag="Apache Access Log"

*.* @@log.ospreyreach.com:12514

Some issues/questions:

  1. This forwards all the syslog files. How can I specify only certain specific files to get forwarded?
  2. This does not seem to collect any data from the file I defined. I see regular syslog messages popping up in my graylog server, but not that file.
  • I think you may need to read a primer on syslog. Syslog doesn't send files, syslog sends messages with both a facility and a priority tag associated with the message. *.* is not a filename, it's saying forward every message from any facility and with any priority. – yoonix May 3 '14 at 4:47

Try this LEGACY rsyslog formatted version:

# Forward apache logs to graylog2 server
$ModLoad imfile # needs to be done just once

$InputFileName /var/log/httpd/access.log
$InputFileTag ApacheAccessLog:
$InputFileStateFile access.log.statefile
$InputFileFacility local4
$InputFileSeverity info

$InputFileName /var/log/httpd/error.log
$InputFileTag ApacheErrorLog:
$InputFileStateFile error.log.statefile
$InputFileFacility local4
$InputFileSeverity error

local4.*                        @@log.ospreyreach.com:12514

You can do similar entries for your other log files.

After that, create some extractors on your graylog2 server for the 12514/TCP input. This will give you some fine grain options for graphs etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.