0

I already figured out that I can send log messages from one of the standard log files to another server by adding these lines to /etc/rsyslog.d/50-default.conf (I'm using ubuntu 16.04):

auth,authpriv.* @@73.147.200.188:514
syslog @@73.147.200.188:514

Now, I want to do the same for apf_log but "apf_log @@73.147.200.188:514" doesn't work.

I've already tried dozens of variations of examples for the imfile module (http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html) including both the old & new versions of the commands with no effect.

The closest I got was adding the line "apf_log /var/log/auth.log" which inserted properly formatted log file entries to auth.log from apf_log even if I didn't actually set up imfile. Unfortunately, I couldn't directly send auth.log entries to my remote server either ("auth.log @@73.147.200.188:514" has no effect).

The documentation of rsyslog's imfile module says "This module provides the ability to convert any standard text file into a syslog message". Using a "state file" it detects when new lines appear and passes them "to rsyslog’s rule engine" (which I assume refers to rules like "syslog @@73.147.200.188:514" and "auth,authpriv.* /var/log/auth.log").

However, it doesn't say what the file's variable name is in that rule engine. I've tried using the file name, its full path, and the imfile "tag" value. I also tried matching these settings in the server (73.147.200.188, in this example) and made sure /var/log/apf_log had full permissions (in both machines).

Dustin

2 Answers 2

0

I managed to do this in order to send logs from kodi on a raspberry pi to a fedora 23 server. I think you just need to specify the facility (local0) and severity (info) both on the imfile and the matching rules. On the pi I added the config file /etc/rsyslog.d/00-pi.conf with:

# try send arbitrary file to remote
$WorkDirectory /var/spool/rsyslog
$ModLoad imfile
$ModLoad imtcp
$InputFileName /home/osmc/.kodi/temp/kodi.log
$InputFileTag mytag1:
$InputFileStateFile imfilestatuskodi
$InputFileFacility local0
$InputFileSeverity info
$InputRunFileMonitor

# send all lines to server
local0.info @@server
& stop

This file is included fairly early on by /etc/rsyslog.conf. On the receiving server I already had a receiving setup /etc/rsyslog.d/00-receive.conf (which you should simplify) with:

$ModLoad imtcp
$InputTCPServerRun 514
$template nomatch,"/var/log/nomatch-%hostname%.log"
# match on pi's ip address
if $fromhost-ip == '192.168.0.20' then {
     action(type="omfile" dynaFile="nomatch")
     stop
}

When I restarted rsyslog on the pi I got all the kodi.log file contents, and subsequent updates, in file /var/log/nomatch-pi.log as expected. On the pi the state file was, as expected, in /var/spool/rsyslog/imfilestatuskodi.

1
  • Thanks for the example. Weird that the examples in the documentation don't include use of custom syslog facilities even though it doesn't look like you can actually do anything with the imfile module unless you set this up. Nov 4, 2017 at 1:27
-1

I also have a running syslog server and tried to figure out how to send another service log to remote syslog server.

In syslog client;

1- following line appended to /etc/rsyslog.conf file Then basic log files are sent to remote syslog server.

*.* @@10.10.10.10:514

2- I created a new file /etc/rsyslog.d/myservice.conf, and used this to transfer /var/log/guacamole.log records to remote syslog server.

cat /etc/rsyslog.d/myservice.conf

$ModLoad imfile
$InputFileName /var/log/guacamole.log
$InputFileTag docker.guacamole:
$InputFileStateFile /tmp/guacamole_state_file
$InputFileSeverity info
$InputFileFacility local3
$InputRunFileMonitor
local3.* @@10.10.10.10

After restarting rsyslog service, guacamole.log is populated in remote syslog server.

More information about modules and parameters: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html

1
  • It would be more helpful if you would explain your example.
    – mnille
    May 6, 2022 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .