rsyslog file log to remote syslog

 1. rsyslog

   [file-A]     <--->    [remote rsyslog]


1) Edit conf file (The filename is your choice.)

  @: udp

  @@: tcp


/etc/rsyslog.d/01-testlog.conf

$ModLoad imfile

# Default Apache Access Log

$InputFileName /var/log/haproxy.log

#$InputFileName /var/log/httpd/access_log

#$InputFileTag httpd-access-default:

#$InputFileStateFile stat-httpd-access

#$InputFileSeverity info

$InputFileFacility local4

$InputRunFileMonitor

$InputFilePollInterval 10

local4.* @127.0.0.1:514


2) ignore local4 from /var/log/message and /var/log/syslog
  edit /etc/rsyslog.conf


Before:
*.*;auth,authpriv.none    -/var/log/syslog

After:

*.*;!(local4.*);auth,authpriv.none    -/var/log/syslog


Before:

*.=debug;\

  auth,authpriv.none;\

  news.none;mail.none -/var/log/debug

*.=info;*.=notice;*.=warn;\

  auth,authpriv.none;\

  cron,daemon.none;\

  mail,news.none    -/var/log/messages

 After:

*.=debug;\

  auth,authpriv.none;\

  news.none;mail.none -/var/log/debug

*.=info;*.=notice;*.=warn;\

  auth,authpriv.none;\

  cron,daemon.none;\

  !(local4.*);\

  mail,news.none    -/var/log/messages


2. restart rsyslog

  systemctl restart rsyslog

Comments

Popular posts from this blog

e1000e 0000:00:1f.6 eno1: Detected Hardware Unit Hang

[WordPress] Change https redirect in DB.

sanitize on in CMakeLists.txt