Using Rsyslog to send application logs to syslog server

19,262

Solution 1

rsyslog has support for reading from a file. This is done with the imfile module. You need the following config:

module(load="imfile" PollingInterval="10") #needs to be done just once

# needs to be done for each file you want to watch
input(type="imfile" File="/path/to/file1" 
     Tag="tag1" 
      StateFile="statefile1" 
      Severity="error" 
      Facility="local7")

There's more information at the rsyslog documentation site

Solution 2

You can always use the old syntax:

eg. /etc/rsyslog.d/11-your-file.conf

$ModLoad imfile

$InputFileName  /app/your-file.log 
$InputFileTag   your-tag
$InputFileStateFile     your-tag 
$InputFileSeverity      info
$InputFileFacility      local7 
$InputRunFileMonitor
$InputFilePersistStateInterval 1000 
local7.*  @@remote-rsyslog-server:port
Share:
19,262

Related videos on Youtube

Lego
Author by

Lego

Updated on September 18, 2022

Comments

  • Lego
    Lego about 1 year

    I'm trying to setup my rsyslog to send logs generated by an application under /opt/appname/logs to a remote syslog server. I have already configured rsyslog to send OS level logs but wanted to see if it can also send logs of an application. I'm not sure if IncludeConfig directive works as it looks for another *.conf file.

    • MadHatter
      MadHatter almost 10 years
      Does the application do its logging via syslog?
    • Lego
      Lego almost 10 years
      I don't think so. This is a tomcat based application and dumps logs to a directory. I wanted them to be fed to a SIEM based application so that we see ALL of them on a central console.