2

enter image description hereI have configured centralized server for my all Linux servers. I can able to forward all system logs and Oracle database audit logs to centralized server. but my problem is all system and database logs are writing in one single file. My requirement is to write database logs to different file and system logs to different file in centralized location. Please find the scripts below.

  • 192.168.1.150 : centralized server

  • 192.168.1.44 : remote server

remote server configuration (192.168.1.44)

$ cat /etc/rsyslog.conf

# Provides UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 514

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

#Save oracle rdbms audit trail to oracle_audit.log
local0.info /u01/app/oracle/admin/prod/adump/oracle_audit.log


*.*     @192.168.1.150:514

Centralized server configuration (192.168.1.150):

$ cat /etc/rsyslog.conf 

# Provides UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 514


$template RemoteHost,"/backup/CentralizeLogLocation/Linuxlogs/%HOSTNAME%/%HOSTNAME%-%$YEAR%%$MONTH%%$DAY%.log"

if ($hostname != '') then ?RemoteHost

& ~

The files are creating in this format for each host in centralised server thsc-vmmanager-20160614.log

Looks like everything is fine -- I got what I want, but both Oracle database audit logs and system logs are writing in one log file. I'm attaching the screenshot as well.

Now the requirement is to separate both the files. Please guide me as to how can I achieve this.

enter image description here

  • which DB are you using ? – Rahul Sep 9 '16 at 9:37
  • Oracle Database 11.2.0.3 & 4 – sanjay.ramaswamy444 Sep 9 '16 at 9:54
  • Since your oracle log messages contain the word "Oracle" why not try to split out these messages with if $msg contains 'Oracle' then -?OracleData followed of course by & ~, where OracleData is another template as in my answer. – meuh Sep 12 '16 at 11:21
  • what does this statement says ?? is it going to copy the oracledatabase audit logs to this template location ?? $template OracleData,"/backup/CentralizeLogLocation/Oracle/%HOSTNAME%/%HOSTNAME%-%$YEAR%%$MONTH%%$DAY%.log" if $syslogfacility-text isequal 'local0' then -?OracleData & ~ if $fromhost-ip startswith '192.168.1' then -?RemoteHost & ~ . /var/log/messages what about this line?? could you please explain the syntax.. – sanjay.ramaswamy444 Sep 14 '16 at 9:26
  • Hi Meuh, what ever you said, i have executed but still no result it copies all system logs and database logs to one file please find the attachment of both code and output of file in screenshots. – sanjay.ramaswamy444 Sep 14 '16 at 10:45
1

You could add syslog facility with %syslogfacility-text% to the remoteHost template like this:

$template RemoteHost,"/backup/CentralizeLogLocation/Linuxlogs/%HOSTNAME%/%HOSTNAME%-%syslogfacility-text%-%$YEAR%%$MONTH%%$DAY%.log"
  • HI, my point is not to make specific name for the file. my point is to to send syslog files to diffrent file and database log to diffrent file. – sanjay.ramaswamy444 Sep 9 '16 at 11:08
1

In your centralized server you have created a template, but you haven't used it. Try adding at the end

if $fromhost-ip startswith 192.168.1.44  then -?RemoteHost
& ~

or

if $syslogfacility-text isequal 'local0' then -?RemoteHost
& ~

or you can combine these to log your remote facility local0, i.e. oracle logs, to one file, and the rest to another, eg:

if $fromhost-ip == '192.168.1.44' and $syslogfacility-text == 'local0' then /var/log/oracle.log
& ~
*.*  /var/log/messages

The & ~ line deletes the oracle messages after they have been saved to the file by the previous if. See rsyslog.com for lots of help and examples.

The filenames in the lines beginning if can be fixed like /var/log/oracle.log, or a template that you have previously defined, like -?OracleData. So you need to add, for example,

$template OracleData,"/backup/CentralizeLogLocation/Oracle/%HOSTNAME%/%HOSTNAME%-%$YEAR%%$MONTH%%$DAY%.log"

if $syslogfacility-text isequal 'local0' then -?OracleData
& ~
if $fromhost-ip startswith '192.168.1' then -?RemoteHost
& ~
*.*  /var/log/messages

Since your oracle log messages contain the word "Oracle" you could alternatively split out these messages with

if $msg contains 'Oracle' then -?OracleData
& ~

Note that the order of these lines matters. The templates must be defined before they are used. The rules are applied to each message in turn. If you do not put the & ~ lines immediately after the if lines, then the message can end up in several log files.

  • hi, local0.info /u01/app/oracle/admin/prod/adump/oracle_audit.log this is my database audit log file in all linux servers. /var/log/messages these are my system logs. these logs are writing in centralised location in one single file. i want these to be seperated in two files. kindly suggest me. – sanjay.ramaswamy444 Sep 9 '16 at 11:09
  • You can write filters, as in my updated answer, to do any sort of redirection to files based on the input. – meuh Sep 9 '16 at 11:38
  • HI Meh, thank you for your immediate response. im very new to this sort of work. i want to write var/log/messages to one file and /u01/app/oracle/admin/prod/adump/oracle_audit.log to another file. please mention in this format $template Remote Host," for all my remote server files. – sanjay.ramaswamy444 Sep 9 '16 at 12:50
  • You dont seem to want a template, so just use fixed filenames, as in my updated answer. There is detailed help on rsyslog here. – meuh Sep 9 '16 at 17:19
  • Hi Meuh, thankyou for your response, i want to save 10 linux server log files in one centralized server, in this case how could i use filters. this $template RemoteHost,"/backup/CentralizeLogLocation/Linuxlogs/%HOSTNAME%/%HOSTNAME%-%$YEAR%%$MONTH%%$DAY%.log" line is saving both database audit logs (oracle_audit.log) and messages (/var/log/messages) in one single file. i want to separate this, in this case can i create one more template to save particular oracle_audit.log to diffrent file. please correct me if im wrong. – sanjay.ramaswamy444 Sep 12 '16 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.