Trying to froward following logs from /home/ddlog/ms/logs/execution_logs/_abc-xyz-ms_* to VMware vRealize Log Insight using rsyslog. For some reason that does not seem to be working.

I have tried using imfile -

# Now load the external log
$InputFileName /home/ddlog/ms/logs/execution_logs/_abc-xyz-ms_*
$InputFileTag ddlog
$InputFileStateFile ms
$InputFileSeverity debug
$InputFileFacility local7
local7.*  @@hostname:514

Commenting out the imfile and updating the rsyslog.conf with the

*.* @@remote-host:514

seems to work perfectly fine but I am more concerned about forwarding specific logs.

  • The last sentence is unclear. Do you mean rsyslog already has the log messages? If so, please check where /home/ddlog/ms/log/... is created/written to in rsyslog.conf. Once we know this, the solution may be very simple. – Rainer Gerhards Apr 25 at 9:55
  • No, what I meant was using the default syntax " . @@hostname:514" I am able to see the boot.log, cron logs, mail logs and /var/log/messages as well which have been configured in rsyslog.conf but when I create a imfile to forward abc-xyz-ms* logs under execution_logs it does not work. – Surya Apr 25 at 15:41
  • If you are using legacy format you probably need to add as first line: $ModLoad imfile – meuh Apr 25 at 17:58
  • I have imfile added under load modules - # Then load modules: $ModLoad imuxsock.so $ModLoad imklog.so $ModLoad imfile However I have made the change and add it as first line as well which does not seems to help. – Surya Apr 25 at 18:51
  • If you are just testing and not adding new data to the files you should remove the state files. InputFileStateFile is deprecated I think. It might not work for a glob where many files cannot use the same state file. Try removing that config line. Check for syntax errors with rsyslogd -N 1. You can get lots of debug output with -dn which might provide a clue. – meuh Apr 26 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.