If I have multiple log files in my /home/logs directory, can I use a wild card to read all the logs and configure rsyslog.conf file like this one ?
$InputFileName /home/logs/*.logs Thanks all >________________________________ > From: Augie Schwer <[email protected]> >To: Abdulnasir Shash <[email protected]>; rsyslog-users ><[email protected]> >Sent: Wednesday, October 24, 2012 7:44 PM >Subject: Re: [rsyslog] Sending Multiple Files to Remote Server > >http://www.rsyslog.com/rhelcentos-rpms/ > >I used the RPMs there to install v7 on a CentOS 5.8 server. > >--Augie > >On Wed, Oct 24, 2012 at 9:57 AM, Abdulnasir Shash <[email protected]> wrote: >> Rainer; >> >> Thank you for quick response. However; I'm using rsyslog that is pre >> installed with RedHat 5.7. When I install the latest version of rsyslog, it >> will give me a library error. What do I have to make the latest version of >> rsyslog to work with RedHat 5.7 >> >> >> >> >> >>>________________________________ >>> From: Rainer Gerhards <[email protected]> >>>To: Abdulnasir Shash <[email protected]>; rsyslog-users >>><[email protected]> >>>Sent: Wednesday, October 24, 2012 11:48 AM >>>Subject: RE: [rsyslog] Sending Multiple Files to Remote Server >>> >>> >>> >>>> -----Original Message----- >>>> From: [email protected] [mailto:rsyslog- >>>> [email protected]] On Behalf Of Abdulnasir Shash >>>> Sent: Wednesday, October 24, 2012 5:46 PM >>>> To: rsyslog-users >>>> Subject: [rsyslog] Sending Multiple Files to Remote Server >>>> >>>> I have two files that i need to send to remote server with the >>>> following rsyslog.conf file >>>> >>>> $InputFileName /home/ashash/ashash1.log >>>> $InputFileTag DIT >>>> $InputFileStateFile DataIntake >>>> #$InputFileSeverity >>>> #$InputFileFacility >>>> $InputRunFileMonitor >>>> $InputFilePollInterval 10 >>>> >>>> >>>> $InputFileName /home/ashash/ashash2.log >>>> $InputFileTag DTR >>>> $InputFileStateFile DataTransmit >>>> #$InputFileSeverity >>>> #$InputFileFacility >>>> $InputRunFileMonitor >>>> $InputFilePollInterval 10 >>>> >>>> >>>> *.* @192.199.10.100 >>>> >>>> # Use traditional timestamp format >>>> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat >>>> >>>> >>>> >>>> The problem is I can only see ashash1.log on remote server. Why can't >>>> I see ashash2.log on the remote server. >>>> >>>> I have attached when I ran it in a debug mode. >>>> >>>> ******************************************************************* >>>> 2340.677147000:main thread: Writing pidfile /var/run/rsyslogd.pid. >>>> 2340.677853000:main thread: rsyslog 3.22.1 - called init() >>> >>>That's an ancient version, it's probably just a bug with that. Use 6.6.0 or >>>-better- 7.2.0 and check if the problem persist. >>> >>>Rainer >>> >>>> 2340.677863000:main thread: Unloading non-static modules. >>>> 2340.677870000:main thread: module lmnet NOT unloaded because it still >>>> has a refcount of 3 >>>> 2340.677875000:main thread: Clearing templates. >>>> 2340.677919000:main thread: cfline: '$ModLoad imfile' >>>> 2340.677932000:main thread: Requested to load module 'imfile' >>>> 2340.677939000:main thread: loading module >>>> '/usr/lib64/rsyslog/imfile.so' >>>> 2340.678048000:main thread: module of type 0 being loaded. >>>> 2340.678060000:main thread: cfline: '$InputFileName >>>> /opt/espds/as/wso2/repository/logs/pda_data-intake_data-pull.log' >>>> 2340.678070000:main thread: cfline: '$InputFileTag DIT' >>>> 2340.678078000:main thread: cfline: '$InputFileStateFile DataIntake' >>>> 2340.678086000:main thread: cfline: '$InputRunFileMonitor' >>>> 2340.678096000:main thread: cfline: '$InputFilePollInterval 10' >>>> 2340.678105000:main thread: cfline: '$InputFileName >>>> /opt/espds/as/wso2/repository/logs/pda_data-transmit_push-data.log' >>>> 2340.678113000:main thread: cfline: '$InputFileTag DTR' >>>> 2340.678122000:main thread: cfline: '$InputFileStateFile >>>> DataTransmit' >>>> 2340.678130000:main thread: cfline: '$InputRunFileMonitor' >>>> 2340.678138000:main thread: cfline: '$InputFilePollInterval 10' >>>> 2340.678147000:main thread: cfline: '*.* @logging.sandbox.pda.org' >>>> 2340.678153000:main thread: - traditional PRI filter >>>> 2340.678206000:main thread: symbolic name: * ==> 255 >>>> 2340.678225000:main thread: tried selector action for builtin-file: - >>>> 2001 >>>> 2340.678235000:main thread: hostname 'logging.sandbox.pda.org', port >>>> '(null)' >>>> 2340.678241000:main thread: tried selector action for builtin-fwd: 0 >>>> 2340.678247000:main thread: Module builtin-fwd processed this config >>>> line. >>>> 2340.678258000:main thread: template: >>>> 'RSYSLOG_TraditionalForwardFormat' assigned >>>> 2340.678275000:main thread: action 1 queue: save on shutdown 1, max >>>> disk space allowed 0 >>>> 2340.678287000:main thread: action 1 queue: type 3, enq-only 0, disk >>>> assisted 0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light >>>> delay 700 starting >>>> 2340.678295000:main thread: Action 0x7338d50: queue 0x7338e60 created >>>> 2340.678303000:main thread: cfline: '$ActionFileDefaultTemplate >>>> RSYSLOG_TraditionalFileFormat' >>>> 2340.678316000:main thread: selector line successfully processed >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST >>>> if you DON'T LIKE THAT. >>> >>> >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > > > >-- >Augie Schwer - [email protected] - http://schwer.us > > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
