Extra entrys in graylog -

sorry omitted the exclude

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

##########################################
#testf listed here for include purposes


$ModLoad imfile

$InputFileName  /usr/local/expensys/test-f/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-test-f-app
$InputFileStateFile     exlog-test-f-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 10
$InputFilePersistStateInterval 0
local7.*  @@192.168.201.222:1514


###########################################

#  exclude 

programname, contains, "exlog-"  ~





#### RULES ####

$RepeatedMsgReduction on

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler
q


# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
#local7.*                                               /dev/null

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
#*.* @@192.168.201.222:1514


# ### end of the forwarding rule ###
#*.* @@172.30.4.106:1514;RSYSLOG_SyslogProtocol23Format

rsyslog will merge the configuration, i. e. your main configuration file and all files referenced via $IncludeConfig.

In order to analyze the issue at hand, one has to know the complete configuration.

On a side note:

You can edit your posts and please use triple back ticks to format your text snippets:

```
TEXT
```

Sure I understand

here you go

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf


######################################################
#INCLUDES PASTED HERE
######################################################
$ModLoad imfile

$InputFileName  /var/log/httpd/access_log
$InputFileTag   exlog-test4-apache-access
$InputFileStateFile    exlog-test4-apache-access
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 10
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/automation-test/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-automation-test-app
$InputFileStateFile     exlog-automation-test-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-alpha/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-ops-alpha-app
$InputFileStateFile     exlog-ops-alpha-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-bravo/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-ops-bravo-app
$InputFileStateFile     exlog-ops-bravo-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/support-alpha/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-support-alpha-app
$InputFileStateFile     exlog-support-alpha-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/support-bravo/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-support-bravo-app
$InputFileStateFile     exlog-support-bravo-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/support-charlie/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-support-charlie-app
$InputFileStateFile     exlog-support-charlie-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/test-f/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-test-f-app
$InputFileStateFile     exlog-test-f-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 10
$InputFilePersistStateInterval 0
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-alpha/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-transform-alpha-app
$InputFileStateFile     exlog-transform-alpha-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-bravo/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-transform-bravo-app
$InputFileStateFile     exlog-transfirm-bravo-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /var/log/bckp
$InputFileTag   exlog-test4-bckp
$InputFileStateFile     exlog-test4-bckp
#$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.268.201.222:1514
:programname, contains, "exlog-"  ~

$ModLoad imfile

$InputFileName  /var/log/maillog
$InputFileTag   exlog-test4-postfix
$InputFileStateFile     exlog-test4-postfix
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.268.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/automation-test/tomcat/logs/catalina.out
$InputFileTag   exlog-automation-test-catalina
$InputFileStateFile     exlog-automation-test-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/build-test-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-build-test-alpha-catalina
$InputFileStateFile     exlog-build-test-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514


$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-ops-alpha-catalina
$InputFileStateFile     exlog-ops-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-bravo/tomcat/logs/catalina.out
$InputFileTag   exlog-ops-bravo-catalina
$InputFileStateFile     exlog-ops-bravo-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/support-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-support-alpha-catalina
$InputFileStateFile     exlog-support-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/support-bravo/tomcat/logs/catalina.out
$InputFileTag   exlog-support-bravo-catalina
$InputFileStateFile     exlog-support-bravo-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514


$ModLoad imfile

$InputFileName  /usr/local/expensys/support-charlie/tomcat/logs/catalina.out
$InputFileTag   exlog-support-charlie-catalina
$InputFileStateFile     exlog-support-charlie-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514

$ModLoad imfile

$InputFileName  /usr/local/expensys/test-f/tomcat/logs/catalina.out
$InputFileTag   exlog-test-f-catalina
$InputFileStateFile     exlog-test-f-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-transform-alpha-catalina
$InputFileStateFile     exlog-transform-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-bravo/tomcat/logs/catalina.out
$InputFileTag   exlog-transform-bravo-catalina
$InputFileStateFile     exlog-transform-bravo-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
local7.*  @@192.168.201.222:1514


############################################################################
# END OF INCLUDES
##########################################################################



#### RULES ####

$RepeatedMsgReduction on

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler



# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
#local7.*                                               /dev/null

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
#*.* @@192.168.201.222:1514


# ### end of the forwarding rule ###
#*.* @@172.30.4.106:1514;RSYSLOG_SyslogProtocol23Format


I think i see what you are saying, I should put the
local7.* @@192.168.201.222:1514

at the end of the main config, and remove from the individual configs?

tried that, didnt get any of the additional configs outputting to graylog

Correct.

I could use these tools, but I dont know how to use them, sorry, also command line only on linux

Ok, have edited as below, however none of the includes are working…

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf


######################################################
#INCLUDES PASTED HERE
######################################################
$ModLoad imfile

$InputFileName  /var/log/httpd/access_log
$InputFileTag   exlog-test4-apache-access
$InputFileStateFile    exlog-test4-apache-access
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 5
$InputFilePersistStateInterval 5


$ModLoad imfile

$InputFileName  /usr/local/expensys/automation-test/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-automation-test-app
$InputFileStateFile     exlog-automation-test-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-alpha/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-ops-alpha-app
$InputFileStateFile     exlog-ops-alpha-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-bravo/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-ops-bravo-app
$InputFileStateFile     exlog-ops-bravo-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/support-alpha/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-support-alpha-app
$InputFileStateFile     exlog-support-alpha-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/support-bravo/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-support-bravo-app
$InputFileStateFile     exlog-support-bravo-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/support-charlie/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-support-charlie-app
$InputFileStateFile     exlog-support-charlie-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/test-f/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-test-f-app
$InputFileStateFile     exlog-test-f-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 10
$InputFilePersistStateInterval 0


$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-alpha/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-transform-alpha-app
$InputFileStateFile     exlog-transform-alpha-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-bravo/tomcat/logs/expensys-local-app.log
$InputFileTag   exlog-transform-bravo-app
$InputFileStateFile     exlog-transfirm-bravo-app
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /var/log/bckp
$InputFileTag   exlog-test4-bckp
$InputFileStateFile     exlog-test4-bckp
#$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
#local7.*  @@192.268.201.222:1514
:programname, contains, "exlog-"  ~

$ModLoad imfile

$InputFileName  /var/log/maillog
$InputFileTag   exlog-test4-postfix
$InputFileStateFile     exlog-test4-postfix
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
#local7.*  @@192.268.201.222:1514
$ModLoad imfile

$InputFileName  /usr/local/expensys/automation-test/tomcat/logs/catalina.out
$InputFileTag   exlog-automation-test-catalina
$InputFileStateFile     exlog-automation-test-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

$ModLoad imfile

$InputFileName  /usr/local/expensys/build-test-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-build-test-alpha-catalina
$InputFileStateFile     exlog-build-test-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1



$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-ops-alpha-catalina
$InputFileStateFile     exlog-ops-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

$ModLoad imfile

$InputFileName  /usr/local/expensys/ops-bravo/tomcat/logs/catalina.out
$InputFileTag   exlog-ops-bravo-catalina
$InputFileStateFile     exlog-ops-bravo-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

$ModLoad imfile

$InputFileName  /usr/local/expensys/support-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-support-alpha-catalina
$InputFileStateFile     exlog-support-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

$ModLoad imfile

$InputFileName  /usr/local/expensys/support-bravo/tomcat/logs/catalina.out
$InputFileTag   exlog-support-bravo-catalina
$InputFileStateFile     exlog-support-bravo-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1



$ModLoad imfile

$InputFileName  /usr/local/expensys/support-charlie/tomcat/logs/catalina.out
$InputFileTag   exlog-support-charlie-catalina
$InputFileStateFile     exlog-support-charlie-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1


$ModLoad imfile

$InputFileName  /usr/local/expensys/test-f/tomcat/logs/catalina.out
$InputFileTag   exlog-test-f-catalina
$InputFileStateFile     exlog-test-f-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-alpha/tomcat/logs/catalina.out
$InputFileTag   exlog-transform-alpha-catalina
$InputFileStateFile     exlog-transform-alpha-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

$ModLoad imfile

$InputFileName  /usr/local/expensys/transform-bravo/tomcat/logs/catalina.out
$InputFileTag   exlog-transform-bravo-catalina
$InputFileStateFile     exlog-transform-bravo-catalina
$InputFileSeverity      info
$InputFileFacility      local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

local7.*  @@192.268.201.222:1514


############################################################################
# END OF INCLUDES
##########################################################################



#### RULES ####

$RepeatedMsgReduction on

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler



# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
#local7.*                                               /dev/null

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
#*.* @@192.168.201.222:1514


# ### end of the forwarding rule ###
#*.* @@172.30.4.106:1514;RSYSLOG_SyslogProtocol23Format

You probably shouldn’t put :programname, contains, "exlog-" ~ in the middle of these configuration blocks (before any output for “local7” or “exlog-*” has been defined).

ok will rename that file to ZZZZZ

That has made no difference

Thanks for the pointers so far

I have resolved the order/contents thanks to your advice, I believe , I will test for the rest of today and let you know the final result

In ./etc/rsyslog.d where all the config file are for importing I have set them as such

AAAAAAAA.conf

local7.* @@x.x.x.x.:1514

Then all the individual log imports (example below)

$InputFileName /usr/local/expensys/ops-alpha/tomcat/logs/logname.log
$InputFileTag exlog-logname
$InputFileStateFile exlog-logname
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
$InputFilePollInterval 1
$InputFilePersistStateInterval 1

then put the ZZZZZ with the exclude at the end

:programname, contains, “exlog-” ~

I have left the entry in rsyslog.conf that captures all logs not containing the exlog tag that we identify our app logs with from local7

. @@x.x.x.x:1514

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.