Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Using Wildcards with rsyslog's File Monitor imfile

Want to monitor log files with rsyslog and use wildcards to monitor a large file set? This presentation shows you how to do that.

Related Books

Free with a 30 day trial from Scribd

See all

Related Audiobooks

Free with a 30 day trial from Scribd

See all

Using Wildcards with rsyslog's File Monitor imfile

  1. 1. Using Wildcards with rsyslog’s File Monitor Rainer Gerhards, rsyslog project lead
  2. 2. Prerequisites ● kernel with inotify support ● at least rsyslog v8.5.0 ● if not available in your distro o use rsyslog package repository (recommended) o build from source ● imfile module (usually in base package)
  3. 3. State Files ● rsyslog needs to know how much of a file it already processed ● upon shutdown a “state file” is created with this information ● stored in rsyslog work directory ● let rsyslog generate the state file name automatically!
  4. 4. Restrictions ● wildcards are support at the file level, not at the directory level o /var/log/applog*.log is valid o /var/applog*/logfile.log is invalid ● subdirectories that match the wildcard are not processed o if /var/log/applog-dir.log is a directory, it will not be processed ● wildcards do not work in polling mode
  5. 5. Base Config Sample global(workDirectory=”/home/rsyslog/spool”)m odule(load=”imfile”) input(type=”imfile” tag=”applog” file=”/var/log/applog*.log”)
  6. 6. Sample: Remote Forwarding global(workDirectory=”/home/rsyslog/spool”) module(load=”imfile”) ruleset(name="infiles") { action(type="omfwd” target=”server.example.net” protocol=”tcp” port=”10514” ) } input(type=”imfile” tag=”applog” file=”/var/log/applog*.log”)
  7. 7. Notes on Remote Forwarding Conf ● forwarding happens totally independent from rest of logging configuration due to use of ruleset ● module() statement must occur only once ● workDirectory o is used for all rsyslog work and state files o must be set only once (usually at top of top level rsyslog.conf)

    Be the first to comment

    Login to see the comments

  • indi06

    Nov. 17, 2014
  • MoisesSilva6

    Nov. 25, 2015
  • fbaligand

    May. 16, 2016
  • gaoyingju

    Oct. 21, 2016
  • CamilloDAvino1

    Oct. 25, 2016
  • kkocaer

    Jul. 19, 2017
  • pulecp

    Dec. 29, 2017

Want to monitor log files with rsyslog and use wildcards to monitor a large file set? This presentation shows you how to do that.

Views

Total views

22,736

On Slideshare

0

From embeds

0

Number of embeds

141

Actions

Downloads

61

Shares

0

Comments

0

Likes

7

×