Using Rsyslog to send application logs to syslog server

Question

I'm trying to setup my rsyslog to send logs generated by an application under /opt/appname/logs to a remote syslog server. I have already configured rsyslog to send OS level logs but wanted to see if it can also send logs of an application. I'm not sure if IncludeConfig directive works as it looks for another *.conf file.

Solution 1

rsyslog has support for reading from a file. This is done with the imfile module. You need the following config:

module(load="imfile" PollingInterval="10") #needs to be done just once
# needs to be done for each file you want to watch
input(type="imfile" File="/path/to/file1" 
     Tag="tag1" 
      StateFile="statefile1" 
      Severity="error" 
      Facility="local7")

There's more information at the rsyslog documentation site

Solution 2

You can always use the old syntax:

eg. /etc/rsyslog.d/11-your-file.conf

$ModLoad imfile
$InputFileName  /app/your-file.log 
$InputFileTag   your-tag
$InputFileStateFile     your-tag 
$InputFileSeverity      info
$InputFileFacility      local7 
$InputRunFileMonitor
$InputFilePersistStateInterval 1000 
local7.*  @@remote-rsyslog-server:port

Comments

[MadHatter]

Does the application do its logging via syslog?

[Lego]

I don't think so. This is a tomcat based application and dumps logs to a directory. I wanted them to be fed to a SIEM based application so that we see ALL of them on a central console.