0

I'm using rsyslog and trying to do the following configuration:

 1. Server 1 - log all local messages and log messages from server2

 2. Server 2 - log all local messages and log messages from server1

Thus, both servers should have contain both their local and remote syslog.

So what I put in the forwarding section rsyslog.conf configuration files are:

SERVER1:

 # ### begin forwarding rule ###
 # The statement between the begin ... end define a SINGLE forwarding
 # rule. They belong together, do NOT split them. If you create multiple
 # forwarding rules, duplicate the whole block!
 # Remote Logging (we use TCP for reliable delivery)
 #
 # An on-disk queue is created for this action. If the remote host is
 # down, messages are spooled to disk and sent when it is up again.
 $WorkDirectory /var/lib/rsyslog # where to place spool files
 $ActionQueueFileName server1 # unique name prefix for spool files
 $ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
 $ActionQueueSaveOnShutdown on # save messages to disk on shutdown
 $ActionQueueType LinkedList   # run asynchronously
 $ActionResumeRetryCount -1    # infinite retries if host is down
 # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
 *.* @@10.0.0.2
 # ### end of the forwarding rule ###

SERVER2:

 # ### begin forwarding rule ###
 # The statement between the begin ... end define a SINGLE forwarding
 # rule. They belong together, do NOT split them. If you create multiple
 # forwarding rules, duplicate the whole block!
 # Remote Logging (we use TCP for reliable delivery)
 #
 # An on-disk queue is created for this action. If the remote host is
 # down, messages are spooled to disk and sent when it is up again.
 $WorkDirectory /var/lib/rsyslog # where to place spool files
 $ActionQueueFileName server2 # unique name prefix for spool files
 $ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
 $ActionQueueSaveOnShutdown on # save messages to disk on shutdown
 $ActionQueueType LinkedList   # run asynchronously
 $ActionResumeRetryCount -1    # infinite retries if host is down
 # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
 *.* @@10.0.0.1
 # ### end of the forwarding rule ###

The problem is that this basically causes a situation like an infinite loop. I.E. each system gets its own and then all new entries coming from each system. Thus this fills up the log files quickly with the identical information being continually replicated over and over again.

Is there some way to do what I want?

I'm using rsyslog v5 (RHEL 6/Centos 6) standard.

1

You might be able to do this using conditionals, although rsyslog syntax configuration is dependent on the version you're running - and that version of CentOS is getting old.

After your udp server configuration (UDPServerRun or lookalike), and before the directives forwarding messages to remote, you could try adding the following:

if $fromhost-ip startswith '10.0.0.' then /var/log/remotelogs.log
& ~

This should send remote logs to a separate file, and prevent further processing/relaying.

Although if you intend to forward syslog messages, I'ld recommend you consider setting up a dedicated syslog proxy/storage server - even two, if keeping duplicate copies is mandatory. If you think a simple syslog server is not worth your time: you could give a look to Logstash (and the ELK stack in general), or Splunk, ... maybe as a side-project.

1
  • my inclination would be to setup a dedicated syslog server however this is a project issue and not mine. – mdpc Feb 9 '17 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.