1

Trying to froward following logs from /home/ddlog/ms/logs/execution_logs/_abc-xyz-ms_* to VMware vRealize Log Insight using rsyslog. For some reason that does not seem to be working.

I have tried using imfile -

# Now load the external log
$InputFileName /home/ddlog/ms/logs/execution_logs/_abc-xyz-ms_*
$InputFileTag ddlog
$InputFileStateFile ms
$InputFileSeverity debug
$InputFileFacility local7
$InputRunFileMonitor
local7.*  @@hostname:514

Commenting out the imfile and updating the rsyslog.conf with the

*.* @@remote-host:514

seems to work perfectly fine but I am more concerned about forwarding specific logs.

5
  • The last sentence is unclear. Do you mean rsyslog already has the log messages? If so, please check where /home/ddlog/ms/log/... is created/written to in rsyslog.conf. Once we know this, the solution may be very simple. Apr 25, 2019 at 9:55
  • No, what I meant was using the default syntax " . @@hostname:514" I am able to see the boot.log, cron logs, mail logs and /var/log/messages as well which have been configured in rsyslog.conf but when I create a imfile to forward abc-xyz-ms* logs under execution_logs it does not work.
    – Surya
    Apr 25, 2019 at 15:41
  • If you are using legacy format you probably need to add as first line: $ModLoad imfile
    – meuh
    Apr 25, 2019 at 17:58
  • I have imfile added under load modules - # Then load modules: $ModLoad imuxsock.so $ModLoad imklog.so $ModLoad imfile However I have made the change and add it as first line as well which does not seems to help.
    – Surya
    Apr 25, 2019 at 18:51
  • If you are just testing and not adding new data to the files you should remove the state files. InputFileStateFile is deprecated I think. It might not work for a glob where many files cannot use the same state file. Try removing that config line. Check for syntax errors with rsyslogd -N 1. You can get lots of debug output with -dn which might provide a clue.
    – meuh
    Apr 26, 2019 at 15:58

1 Answer 1

0

Hard to tell without the relevant syslog content. But, my guess would be file permission issues as rsyslog drops permissions to syslog and you are trying to track /home/ddlog/.. path.

If so then there are a couple of ways around that like adding syslog user to the ddlog user group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .