1

I have rsyslog configured to listen on UDP/514 for syslogs from other devices in my environment, but I have a certain logs that cannot be sent through normal UDP/TCP syslog and the only way to do so is to send the actual log file when it is rotated using SCP.

I have already configured all of the rsyslog to work as expected for the UDP connections, but now I am trying to figure out how to have rsyslog process the log files copied using SCP and include them in the same file that they would've been placed if they have been received through the syslog port.

I have the servers set up to copy the files into a temporary location /scp_tmp/[source_ip_address]/syslog.log and I have read the documentation on imfile and I am certain on how to get rsyslog to read the file and output it to the intended file, but the issue that stands is that I need to set up the property fromhost-ip to [source_ip_address] for the templates I have in place to work properly.

I know how to extract this property/value from the path in Bash, but is there a way to do so within rsyslog? Does rsyslog.conf allow command substitution?

Notes:

  • The reason why I'm having this issue is that the logs generated by the server do not include hostname and the format cannot be altered since they come from software with limited configuration flexibility.
  • Running rsyslogd 8.2004.0
  • Running RHEL 6.10
0

You cannot change standard properties like fromhost-ip. You can, however, set a local variable to a string and use it like a property. Eg

template(name="abc" type="string" string="note %$.myvar%")
set $.myvar = "this-value";

Also, imfile allows you to retrieve the filename as metadata provided you use the option addMetadata:

input(type="imfile"
      File="/my/logs/*.log"
      addMetadata="on")

The filename is put in variable $!metadata!filename.

So, if you change your config to set by default

set $.myvar = $fromhost-ip;

and override it just for imfile, you can then use if $.myvar rather than if $fromhost-ip in your rules, and have common rules for all input.

| improve this answer | |
  • This answers half my question. The issue is still that the fromhost-ip I want to test against is not in the filename, but in the directory name. Is there a way I could assign $.myvar with a script or something that runs on the shell? – AnthonyBB May 5 at 16:27
  • filename is a misnomer, as it contains the full path, depending on your glob pattern, eg /my/logs/999.log. You can extract the directory from that inside rsyslog using regex or field split of properties. Probably worth a separate question. – meuh May 5 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.