How do I send messages from random log file (such as apf_log) to another computer?

Question

I already figured out that I can send log messages from one of the standard log files to another server by adding these lines to /etc/rsyslog.d/50-default.conf (I'm using ubuntu 16.04):

auth,authpriv.* @@73.147.200.188:514
syslog @@73.147.200.188:514

Now, I want to do the same for apf_log but "apf_log @@73.147.200.188:514" doesn't work.

I've already tried dozens of variations of examples for the imfile module (http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html) including both the old & new versions of the commands with no effect.

The closest I got was adding the line "apf_log /var/log/auth.log" which inserted properly formatted log file entries to auth.log from apf_log even if I didn't actually set up imfile. Unfortunately, I couldn't directly send auth.log entries to my remote server either ("auth.log @@73.147.200.188:514" has no effect).

The documentation of rsyslog's imfile module says "This module provides the ability to convert any standard text file into a syslog message". Using a "state file" it detects when new lines appear and passes them "to rsyslog’s rule engine" (which I assume refers to rules like "syslog @@73.147.200.188:514" and "auth,authpriv.* /var/log/auth.log").

However, it doesn't say what the file's variable name is in that rule engine. I've tried using the file name, its full path, and the imfile "tag" value. I also tried matching these settings in the server (73.147.200.188, in this example) and made sure /var/log/apf_log had full permissions (in both machines).

Dustin

Answer 1

I managed to do this in order to send logs from kodi on a raspberry pi to a fedora 23 server. I think you just need to specify the facility (local0) and severity (info) both on the imfile and the matching rules. On the pi I added the config file /etc/rsyslog.d/00-pi.conf with:

# try send arbitrary file to remote
$WorkDirectory /var/spool/rsyslog
$ModLoad imfile
$ModLoad imtcp
$InputFileName /home/osmc/.kodi/temp/kodi.log
$InputFileTag mytag1:
$InputFileStateFile imfilestatuskodi
$InputFileFacility local0
$InputFileSeverity info
$InputRunFileMonitor

# send all lines to server
local0.info @@server
& stop

This file is included fairly early on by /etc/rsyslog.conf. On the receiving server I already had a receiving setup /etc/rsyslog.d/00-receive.conf (which you should simplify) with:

$ModLoad imtcp
$InputTCPServerRun 514
$template nomatch,"/var/log/nomatch-%hostname%.log"
# match on pi's ip address
if $fromhost-ip == '192.168.0.20' then {
     action(type="omfile" dynaFile="nomatch")
     stop
}

When I restarted rsyslog on the pi I got all the kodi.log file contents, and subsequent updates, in file /var/log/nomatch-pi.log as expected. On the pi the state file was, as expected, in /var/spool/rsyslog/imfilestatuskodi.

Answer 2

I also have a running syslog server and tried to figure out how to send another service log to remote syslog server.

In syslog client;

1- following line appended to /etc/rsyslog.conf file Then basic log files are sent to remote syslog server.

*.* @@10.10.10.10:514

2- I created a new file /etc/rsyslog.d/myservice.conf, and used this to transfer /var/log/guacamole.log records to remote syslog server.

cat /etc/rsyslog.d/myservice.conf

$ModLoad imfile
$InputFileName /var/log/guacamole.log
$InputFileTag docker.guacamole:
$InputFileStateFile /tmp/guacamole_state_file
$InputFileSeverity info
$InputFileFacility local3
$InputRunFileMonitor
local3.* @@10.10.10.10

After restarting rsyslog service, guacamole.log is populated in remote syslog server.

More information about modules and parameters: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html