All; I have my rsyslog.conf setiing as follow; $ModLoad imfile $InputFileName /root/test.log $InputFileTag test $InputFileStateFile TestData #InputFileSeverity #InputFileFacility $InputFileMonitor $InputFilePollInterval 1 *.* @192.168.100.150 When I start rsyslog from a commandline, I can send my "test.log" to the remote server (192.168.100.150). However, the problem is when I try to start rsyslog when I reboot my redhat operatiog system. When I reboot redhat operating system, I can see rsyslog is running (ps -ef | grep rsyslog), but NO log messages (test.log) will be sent to the remote server (192.168.100.150). Please advice. Thank You.
>________________________________ > From: David Lang <[email protected]> >To: Abdulnasir Shash <[email protected]>; rsyslog-users ><[email protected]> >Cc: Todd Mortensen <[email protected]> >Sent: Monday, December 10, 2012 11:20 PM >Subject: Re: [rsyslog] Sending Multiple Files to Remote Server > >What did you try to do? I suspect that you need a bunch more items for each of >the additional entries. > >David Lang > >On Mon, 10 Dec 2012, Abdulnasir Shash wrote: > >> When I did that I can only read the first input file and the rest of the >> input files have been ignored. >> >> >> >> >>> ________________________________ >>> From: Todd Mortensen <[email protected]> >>> To: Abdulnasir Shash <[email protected]>; rsyslog-users >>> <[email protected]> >>> Cc: Augie Schwer <[email protected]> >>> Sent: Monday, December 10, 2012 3:17 PM >>> Subject: Re: [rsyslog] Sending Multiple Files to Remote Server >>> >>> Currently no, you need to setup a file input entry for each file. >>> >>> On Mon, Dec 10, 2012 at 12:10 PM, Abdulnasir Shash <[email protected]> >>> wrote: >>>> If I have multiple log files in my /home/logs directory, can I use a wild >>>> card to read all the logs and configure rsyslog.conf file like this one ? >>>> >>>> >>>> $InputFileName /home/logs/*.logs >>>> >>>> Thanks all >>>> >>>> >>>> >>>> >>>> >>>> >>>>> ________________________________ >>>>> From: Augie Schwer <[email protected]> >>>>> To: Abdulnasir Shash <[email protected]>; rsyslog-users >>>>> <[email protected]> >>>>> Sent: Wednesday, October 24, 2012 7:44 PM >>>>> Subject: Re: [rsyslog] Sending Multiple Files to Remote Server >>>>> >>>>> http://www.rsyslog.com/rhelcentos-rpms/ >>>>> >>>>> I used the RPMs there to install v7 on a CentOS 5.8 server. >>>>> >>>>> --Augie >>>>> >>>>> On Wed, Oct 24, 2012 at 9:57 AM, Abdulnasir Shash <[email protected]> >>>>> wrote: >>>>>> Rainer; >>>>>> >>>>>> Thank you for quick response. However; I'm using rsyslog that is pre >>>>>> installed with RedHat 5.7. When I install the latest version of rsyslog, >>>>>> it will give me a library error. What do I have to make the latest >>>>>> version of rsyslog to work with RedHat 5.7 >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> ________________________________ >>>>>>> From: Rainer Gerhards <[email protected]> >>>>>>> To: Abdulnasir Shash <[email protected]>; rsyslog-users >>>>>>> <[email protected]> >>>>>>> Sent: Wednesday, October 24, 2012 11:48 AM >>>>>>> Subject: RE: [rsyslog] Sending Multiple Files to Remote Server >>>>>>> >>>>>>> >>>>>>> >>>>>>>> -----Original Message----- >>>>>>>> From: [email protected] [mailto:rsyslog- >>>>>>>> [email protected]] On Behalf Of Abdulnasir Shash >>>>>>>> Sent: Wednesday, October 24, 2012 5:46 PM >>>>>>>> To: rsyslog-users >>>>>>>> Subject: [rsyslog] Sending Multiple Files to Remote Server >>>>>>>> >>>>>>>> I have two files that i need to send to remote server with the >>>>>>>> following rsyslog.conf file >>>>>>>> >>>>>>>> $InputFileName /home/ashash/ashash1.log >>>>>>>> $InputFileTag DIT >>>>>>>> $InputFileStateFile DataIntake >>>>>>>> #$InputFileSeverity >>>>>>>> #$InputFileFacility >>>>>>>> $InputRunFileMonitor >>>>>>>> $InputFilePollInterval 10 >>>>>>>> >>>>>>>> >>>>>>>> $InputFileName /home/ashash/ashash2.log >>>>>>>> $InputFileTag DTR >>>>>>>> $InputFileStateFile DataTransmit >>>>>>>> #$InputFileSeverity >>>>>>>> #$InputFileFacility >>>>>>>> $InputRunFileMonitor >>>>>>>> $InputFilePollInterval 10 >>>>>>>> >>>>>>>> >>>>>>>> *.* @192.199.10.100 >>>>>>>> >>>>>>>> # Use traditional timestamp format >>>>>>>> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> The problem is I can only see ashash1.log on remote server. Why can't >>>>>>>> I see ashash2.log on the remote server. >>>>>>>> >>>>>>>> I have attached when I ran it in a debug mode. >>>>>>>> >>>>>>>> ******************************************************************* >>>>>>>> 2340.677147000:main thread: Writing pidfile /var/run/rsyslogd.pid. >>>>>>>> 2340.677853000:main thread: rsyslog 3.22.1 - called init() >>>>>>> >>>>>>> That's an ancient version, it's probably just a bug with that. Use >>>>>>> 6.6.0 or -better- 7.2.0 and check if the problem persist. >>>>>>> >>>>>>> Rainer >>>>>>> >>>>>>>> 2340.677863000:main thread: Unloading non-static modules. >>>>>>>> 2340.677870000:main thread: module lmnet NOT unloaded because it still >>>>>>>> has a refcount of 3 >>>>>>>> 2340.677875000:main thread: Clearing templates. >>>>>>>> 2340.677919000:main thread: cfline: '$ModLoad imfile' >>>>>>>> 2340.677932000:main thread: Requested to load module 'imfile' >>>>>>>> 2340.677939000:main thread: loading module >>>>>>>> '/usr/lib64/rsyslog/imfile.so' >>>>>>>> 2340.678048000:main thread: module of type 0 being loaded. >>>>>>>> 2340.678060000:main thread: cfline: '$InputFileName >>>>>>>> /opt/espds/as/wso2/repository/logs/pda_data-intake_data-pull.log' >>>>>>>> 2340.678070000:main thread: cfline: '$InputFileTag DIT' >>>>>>>> 2340.678078000:main thread: cfline: '$InputFileStateFile DataIntake' >>>>>>>> 2340.678086000:main thread: cfline: '$InputRunFileMonitor' >>>>>>>> 2340.678096000:main thread: cfline: '$InputFilePollInterval 10' >>>>>>>> 2340.678105000:main thread: cfline: '$InputFileName >>>>>>>> /opt/espds/as/wso2/repository/logs/pda_data-transmit_push-data.log' >>>>>>>> 2340.678113000:main thread: cfline: '$InputFileTag DTR' >>>>>>>> 2340.678122000:main thread: cfline: '$InputFileStateFile >>>>>>>> DataTransmit' >>>>>>>> 2340.678130000:main thread: cfline: '$InputRunFileMonitor' >>>>>>>> 2340.678138000:main thread: cfline: '$InputFilePollInterval 10' >>>>>>>> 2340.678147000:main thread: cfline: '*.* @logging.sandbox.pda.org' >>>>>>>> 2340.678153000:main thread: - traditional PRI filter >>>>>>>> 2340.678206000:main thread: symbolic name: * ==> 255 >>>>>>>> 2340.678225000:main thread: tried selector action for builtin-file: - >>>>>>>> 2001 >>>>>>>> 2340.678235000:main thread: hostname 'logging.sandbox.pda.org', port >>>>>>>> '(null)' >>>>>>>> 2340.678241000:main thread: tried selector action for builtin-fwd: 0 >>>>>>>> 2340.678247000:main thread: Module builtin-fwd processed this config >>>>>>>> line. >>>>>>>> 2340.678258000:main thread: template: >>>>>>>> 'RSYSLOG_TraditionalForwardFormat' assigned >>>>>>>> 2340.678275000:main thread: action 1 queue: save on shutdown 1, max >>>>>>>> disk space allowed 0 >>>>>>>> 2340.678287000:main thread: action 1 queue: type 3, enq-only 0, disk >>>>>>>> assisted 0, maxFileSz 1048576, qsize 0, child 0, full delay 970, light >>>>>>>> delay 700 starting >>>>>>>> 2340.678295000:main thread: Action 0x7338d50: queue 0x7338e60 created >>>>>>>> 2340.678303000:main thread: cfline: '$ActionFileDefaultTemplate >>>>>>>> RSYSLOG_TraditionalFileFormat' >>>>>>>> 2340.678316000:main thread: selector line successfully processed >>>>>>>> _______________________________________________ >>>>>>>> rsyslog mailing list >>>>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>>>>> http://www.rsyslog.com/professional-services/ >>>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST >>>>>>>> if you DON'T LIKE THAT. >>>>>>> >>>>>>> >>>>>>> >>>>>> _______________________________________________ >>>>>> rsyslog mailing list >>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>>> http://www.rsyslog.com/professional-services/ >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>>> DON'T LIKE THAT. >>>>> >>>>> >>>>> >>>>> -- >>>>> Augie Schwer - [email protected] - http://schwer.us/ >>>>> >>>>> >>>>> >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>> >>> >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
