I do this by running 2 rsyslog processes, one for local logs just like all other installations and one that does only log collection. The log collection one has it's own init, config and pid file. This way I can rely on packaged config for local logging being identical in production and a secondary package for log collection that only includes the conf and init script depending on the standard rsyslog package.
/usr/sbin/rsyslogd -c4 -f /etc/rsyslog-collector.conf -i /var/run/rsyslogd-collector.pid On Mon, Jan 11, 2010 at 10:42 AM, <[email protected]> wrote: > On Mon, 11 Jan 2010, Dirk H. Schulz wrote: > >> Hi folks, >> >> I am running two central logservers using rsyslog that several dozen >> servers report to (mostly also rsyslog). >> >> The central logservers are writing everything into a database and >> additionally into local logfiles. >> >> I would like to change configuration in a way that only local messages >> are written to local logfiles, and all messages (local and received from >> remote servers) into the database. > > yes, I do something similar to this on my systems. > > All logs except local logs get written to local files, all local logs get > sent over the network (at which point they then get picked up as remote > logs), and all logs (local or remote) get sent to a remote system. > > :fromhost, !isequal, "127.0.0.1" /var/log/messages;TraditionalFormat > :fromhost, isequal, "127.0.0.1" @192.168.1.8;TraditionalForwardFormat > *.* @192.168.1.2 > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
