The *.* call linux_forward was the key. Much cleaner. Thanks! I also see the audit logs in the debug log and at the other end in tcpdump. I don't see the messages in the remote log system data, but that's another issue and product receiving the logs.
I added addMetadata to the module load and a metadata entry to the input but get debug errors. I guess metadata isn't supported in this old version or am I missing something else? ... rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog.all.conf, on or before line 1: parameter 'addMetadata' not known -- typo in config file? [v8.24.0-34.el7 try http://www.rsyslog.com/e/2207 ] ... 1789.633979501:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.d/rsyslog.linux.conf, on or before line 17: parameter 'metadata' not known -- typo in config file? rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog.linux.conf, on or before line 17: parameter 'metadata' not known -- typo in config file? [v8.24.0-34.el7 try http://www.rsyslog.com/e/2207 ] ... module(load="imfile" mode="inotify" addMetadata="on") global ( parser.dropTrailingLFOnReception="on" parser.escapeControlCharactersOnReceive="on" workDirectory="/var/lib/rsyslog" ) ruleset( name="linux_forward" queue.type="LinkedList" queue.filename="FwdRule0" queue.maxDiskSpace="1g" queue.saveOnShutdown="on" ) { action( type="omfwd" target="2001:4888:a00:3154:f0:ff2:0:b01" # logserver VIP protocol="tcp" port="5544" action.resumeRetryCount="-1" ) } *.* call linux_forward input( type="imfile" ruleset="linux_forward" tag="audit" file="/var/log/audit/audit.log" metadata="filename" ) -----Original Message----- From: Rainer Gerhards [mailto:[email protected]] Sent: Wednesday, April 03, 2019 10:26 AM To: Gorman, Kevin Cc: rsyslog-users Subject: Re: [rsyslog] [E] Re: Help with newer syntax a ruleset and forwarding El mié., 3 abr. 2019 a las 17:13, Gorman, Kevin (<[email protected]>) escribió: > > I'm using any and all docs on > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rsyslog.com_doc_v8-2Dstable&d=DwIFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=stJ62L_yqJWGrxRl6wWPMpHwvVUmOyXDBgn3Xxfk-6U&m=l98nK1LGc7XvzQocBxz0C-beuBDTTA_0A-BxOzUwFG0&s=M4v2Mr09OpuPe6E_YDxsM_PPIOsvcPbnav9gu73kKaE&e=, > posts on the internet, etc. The thing is there are few actual configuration > examples and info on how to actually use the various syntax for rsyslog, but > lots of references on what individual parts do, which makes it difficult for > someone not familiar with it to get anything done. I asked because the parameters you gave simply did not exist, thus the syntax error. The online doc is for the currently selected version. With outdated versions like 8.24.0 you should probably stick to the OS provided doc package. That just as info. It is impossible to provide full config examples for everything - there are more potential configs than atoms in the universe (really!). It would be good if users would contribute their configs to the doc, but this does not happen so far :-( > > The version is 8.24 on RHEL 7.6 using the default rsyslog.conf. Here is the > complete config. > > There is no problem collecting or forwarding log data defined in > rsyslog.conf. I simply want to define the address, port and protocol once and > only once. > > I am having trouble forwarding the other 2 sample log files, or rather > audit.log since ansible.log is always empty. Audit.log is not defined in > rsyslog.conf and is pretty busy, but I don't see data in tcpdump on the local > server or in the remote log server. > > From the debug output below, everything looks ok to me. > Let me have a look. Warning: I don't remember what was at the time we had 8.24 (probably 2.5 yrs ago), > # cat rsyslog.all.conf > module(load="imfile" mode="inotify") > > global ( > parser.dropTrailingLFOnReception="on" > parser.escapeControlCharactersOnReceive="on" > workDirectory="/var/lib/rsyslog" > ) > > ruleset(name="linux_forward") { > action( > type="omfwd" > target="2001:4888:a00:3154:f0:ff2:0:b01" # logserver VIP > protocol="tcp" > port="5544" > ) > stop stop is unnecessary here, but causes no issue. > } > > *.* action( > type="omfwd" > target="2001:4888:a00:3154:f0:ff2:0:b01" > port="5544" > protocol="tcp" > ) replace by call linux_forward > > # cat rsyslog.linux.conf > > input( > type="imfile" > ruleset="linux_forward" > tag="ansible" > file="/var/log/ansible.log" > ) > > input( > type="imfile" > ruleset="linux_forward" > tag="audit" > file="/var/log/audit/audit.log" > ) looks good > > # grep -v ^# /etc/rsyslog.conf > > $ModLoad imuxsock # provides support for local system logging (e.g. > via logger command) $ModLoad imjournal # provides access to the > systemd journal $WorkDirectory /var/lib/rsyslog > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > $IncludeConfig /etc/rsyslog.d/*.conf $OmitLocalLogging on > $IMJournalStateFile imjournal.state > *.info;mail.none;authpriv.none;cron.none /var/log/messages > authpriv.* /var/log/secure > mail.* -/var/log/maillog > cron.* /var/log/cron > *.emerg :omusrmsg:* > uucp,news.crit /var/log/spooler > local7.* /var/log/boot.log looks good > > # rsyslogd -N2 2>&1 > rsyslogd: version 8.24.0-34.el7, config validation run (level 2), > master config /etc/rsyslog.conf > > 2612.391124552:main thread : debug level 2 set via config file > 2612.391137687:main thread : This is rsyslog version 8.24.0-34.el7 > 2612.391142024:main thread : config parser: reached end of file > /etc/rsyslog.d/rsyslog.debug.conf at least one of the includede files is missing - if others are missing they may have problems... [snip] > rsyslogd: End of config validation run. Bye. > except for the call, I don't see an issue. As a test, do an upgrade to the currently supported version. If it works, you have hit an already solved bug. HTH Rainer > > > > -----Original Message----- > From: Rainer Gerhards [mailto:[email protected]] > Sent: Wednesday, April 03, 2019 2:04 AM > To: rsyslog-users > Cc: Gorman, Kevin > Subject: Re: [rsyslog] [E] Re: Help with newer syntax a ruleset and > forwarding > > > *.* action( > > type="omfwd" > > ruleset="linux_forward" > > tag="rsyslog" > > name="rsyslog" > > ) > > Which doc do you use as reference for this? Or, more general, which doc link > do you use to craft the configs? > > Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
