0

I already figured out that I can send log messages from one of the standard log files to another server by adding these lines to /etc/rsyslog.d/50-default.conf (I'm using ubuntu 16.04):

auth,authpriv.* @@73.147.200.188:514
syslog @@73.147.200.188:514

Now, I want to do the same for apf_log but "apf_log @@73.147.200.188:514" doesn't work.

I've already tried dozens of variations of examples for the imfile module (http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html) including both the old & new versions of the commands with no effect.

The closest I got was adding the line "apf_log /var/log/auth.log" which inserted properly formatted log file entries to auth.log from apf_log even if I didn't actually set up imfile. Unfortunately, I couldn't directly send auth.log entries to my remote server either ("auth.log @@73.147.200.188:514" has no effect).

The documentation of rsyslog's imfile module says "This module provides the ability to convert any standard text file into a syslog message". Using a "state file" it detects when new lines appear and passes them "to rsyslog’s rule engine" (which I assume refers to rules like "syslog @@73.147.200.188:514" and "auth,authpriv.* /var/log/auth.log").

However, it doesn't say what the file's variable name is in that rule engine. I've tried using the file name, its full path, and the imfile "tag" value. I also tried matching these settings in the server (73.147.200.188, in this example) and made sure /var/log/apf_log had full permissions (in both machines).

Dustin

0

I managed to do this in order to send logs from kodi on a raspberry pi to a fedora 23 server. I think you just need to specify the facility (local0) and severity (info) both on the imfile and the matching rules. On the pi I added the config file /etc/rsyslog.d/00-pi.conf with:

# try send arbitrary file to remote
$WorkDirectory /var/spool/rsyslog
$ModLoad imfile
$ModLoad imtcp
$InputFileName /home/osmc/.kodi/temp/kodi.log
$InputFileTag mytag1:
$InputFileStateFile imfilestatuskodi
$InputFileFacility local0
$InputFileSeverity info
$InputRunFileMonitor

# send all lines to server
local0.info @@server
& stop

This file is included fairly early on by /etc/rsyslog.conf. On the receiving server I already had a receiving setup /etc/rsyslog.d/00-receive.conf (which you should simplify) with:

$ModLoad imtcp
$InputTCPServerRun 514
$template nomatch,"/var/log/nomatch-%hostname%.log"
# match on pi's ip address
if $fromhost-ip == '192.168.0.20' then {
     action(type="omfile" dynaFile="nomatch")
     stop
}

When I restarted rsyslog on the pi I got all the kodi.log file contents, and subsequent updates, in file /var/log/nomatch-pi.log as expected. On the pi the state file was, as expected, in /var/spool/rsyslog/imfilestatuskodi.

  • Thanks for the example. Weird that the examples in the documentation don't include use of custom syslog facilities even though it doesn't look like you can actually do anything with the imfile module unless you set this up. – Dustin Soodak Nov 4 '17 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.