I have rsyslog configured to listen on UDP/514 for syslogs from other devices in my environment, but I have a certain logs that cannot be sent through normal UDP/TCP syslog and the only way to do so is to send the actual log file when it is rotated using SCP.
I have already configured all of the rsyslog to work as expected for the UDP connections, but now I am trying to figure out how to have rsyslog process the log files copied using SCP and include them in the same file that they would've been placed if they have been received through the syslog port.
I have the servers set up to copy the files into a temporary location
/scp_tmp/[source_ip_address]/syslog.log and I have read the documentation on imfile and I am certain on how to get rsyslog to read the file and output it to the intended file, but the issue that stands is that I need to set up the property
[source_ip_address] for the templates I have in place to work properly.
I know how to extract this property/value from the path in Bash, but is there a way to do so within rsyslog? Does rsyslog.conf allow command substitution?
- The reason why I'm having this issue is that the logs generated by the server do not include hostname and the format cannot be altered since they come from software with limited configuration flexibility.
- Running rsyslogd 8.2004.0
- Running RHEL 6.10