Application log

Graylog Central (peer support)
1

i am running ubuntu server, and i have custom application saving logs to /var/logs/redo/redo.log

how to configure rsyslog to send this to graylog server ?

2

Create file in /etc/rsyslog.d/my_application.conf with content:

$ActionQueueType LinkedList # use asynchronous processing
# set file name, also enables disk mode,
# this value must be unique inside all configs
$ActionQueueFileName srvrfwd
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
# max limit the number of messages that queue can contain
$ActionQueueSize 10000
$ActionQueueMaxFileSize 10M # limit the size of queue buffer on disk
$ModLoad imfile # needs to be done just once

# File 1
$InputFileName /var/log/file1 # path to log file
$InputFileTag tag1: # identification of process
$InputFileStateFile stat-file1

$InputFileSeverity error # severity level
$InputFileFacility local7 # facility level
$InputRunFileMonitor

if $programname == 'tag1' then @@graylog.example.org:1514;RSYSLOG_SyslogProtocol23Format

Use @@ for TCP input or @ for UDP Input.

3

thank you, what are those two lines for:

$InputFileTag tag1: # identification of process
$InputFileStateFile stat-file1

4

InputFileTag you use for tag (name) your input file log file. Next you use it in if contition to forward to syslog server (graylog) - last line.

1 Like
5

on Ubuntu 14.04 am getting the following:

rsyslogd: version 7.4.4, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: action ‘InputFileStateFile’ treated as ‘:omusrmsg:InputFileStateFile’ - please change syntax, ‘InputFileStateFile’ will not be supported in the future [try http://www.rsyslog.com/e/2184 ]
rsyslogd: user name ‘InputFil…’ too long - ignored
rsyslogd: action ‘stat-access’ treated as ‘:omusrmsg:stat-access’ - please change syntax, ‘stat-access’ will not be supported in the future [try http://www.rsyslog.com/e/2184 ]
rsyslogd: user name ‘stat-acc…’ too long - ignored
rsyslogd: imfile error: not state file name given, file monitor can not be created [try http://www.rsyslog.com/e/2046 ]
rsyslogd: imfile: no files configured to be monitored - no input will be gathered [try http://www.rsyslog.com/e/2212 ]
rsyslogd: End of config validation run. Bye.

6

upgrading rsyslog to version 8 on Ubuntu 14.04 resolved the issue

1 Like
7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.