Home / server / Questions / 396136
Accepted
Kevin Campion
Asked: 2012-06-07 07:36:05 +0800 CST

How to forward specific log file outside of /var/log with rsyslog to remote server?

  • 772

How can I forward message from a specific log file like /www/myapp/log/test.log with rsyslog client to remote rsyslog server? This log file is outside of the directory /var/log.

log-files rsyslog

2 Answers

  1. Best Answer

    Just setup an imfile rule in your /etc/rsyslog.conf

    #/etc/rsyslog.conf
$ModLoad imfile
$InputFileName /data/mysql/error.log
$InputFileTag mysql-error
$InputFileStateFile stat-mysql-error
$InputFileSeverity error
$InputFileFacility local3
$InputRunFileMonitor
local3.* @@hostname:<portnumber>

    This watches a file and saves to the local3 facility in syslog. Then you can send all data from the local3 facility to your remote server. You may also want to add the following to your rsyslog conf (usually /etc/rsyslog.d/50-default.conf on Ubuntu) to not save the local3 facility to /var/log/syslog:

    #/etc/rsyslog.d/50-default.conf
*.*;auth,authpriv.none,local1.none,local2.none,local3.none,local4.none,local5.none,local6.none          -/var/log/syslog

    Additionally, I would encourage some reading from the following rsyslog docs for more advanced filtering:

    1. The Property Replacer
    2. Filter Conditions
    • 45

  2. On ubuntu, I had to also comment out the drop privileges lines in order to get the rsyslog to actually read the log file outside of /var/logs.

    #/etc/rsyslog.conf
$ModLoad imfile
$InputFileName /data/mysql/error.log
$InputFileTag mysql-error
$InputFileStateFile stat-mysql-error
$InputFileSeverity error
$InputFileFacility local3
$InputRunFileMonitor
local3.* @@hostname:<portnumber>

# Set the default permissions for all log files.
#
#$FileOwner syslog
#$FileGroup adm
#$FileCreateMode 0640
#$DirCreateMode 0755
#$Umask 0022
#$PrivDropToUser syslog
#$PrivDropToGroup syslog
    • 1