> -----Original Message----- > From: A.M Shash [mailto:[email protected]] > Sent: Tuesday, March 19, 2013 3:17 PM > To: David Lang; rsyslog-users > Cc: Rainer Gerhards > Subject: Re: [rsyslog] rsyslog.conf configuration > > David; > > Thanks; I need to clarify a bit more. Both /var/log/messages and > /var/log/myfile.log files are local to the host. I need to send > /var/log/messages (which caprtures system logs) and /var/log/myfile.log > (which catuptures log for my software running on the host) to a remote > server. My only problem when I send both files, the content of > /var/log/myfile.log will be written inside /var/log/messages. Which I don't > want that to happen. Please advice. Thank You
It would help if you posted you complete config ;) Rainer > > > > From: David Lang <[email protected]> > To: A.M Shash <[email protected]>; rsyslog-users > <[email protected]> > Cc: Rainer Gerhards <[email protected]> > Sent: Monday, March 18, 2013 5:17 PM > Subject: Re: [rsyslog] rsyslog.conf configuration > > > On Mon, 18 Mar 2013, A.M Shash wrote: > > > Date: Mon, 18 Mar 2013 12:00:13 -0700 (PDT) > > From: A.M Shash <[email protected]> > > To: Rainer Gerhards <[email protected]>, > > rsyslog-users <[email protected]> > > Subject: [rsyslog] rsyslog.conf configuration > > > > Dear; I have an rsyslog.conf file to forward /var/log/messages file > and the local log file /var/log/myfile.log to remote server. All of of the > content of /var/log/messages and /var/log/myfile.log are forwarded to > remote server. However; all of the content of /var/log/myfile.log file is > written to /var/log/messages file. How should I stop the content of > /var/log/myfile.log from writing to /var/log/messages ? The sample > rsyslog.conf file looks as follow; > > > #Text File Input Module > > $ModLoad imfile > > $ModLoad imklog > > $ModLoad imuxsock > > > > *.info;mail.none;authpriv.none;cron.none /var/log/messages > > > > $InputFileName /var/log/myfile.log > > $InputFileTag PDA > > $InputFileStateFile dpush > > #$InputFileSeverity > > #$InputFileFacility > > $InputRunFileMonitor > > $InputFilePollInterval 10 > > _______________________________________________ > > This isn't your complete configuration (it doesn't show the output to > the remote system for example) > > There are two ways you can do this. > > 1. make a series of rules along the lines of > > send everything to the remote server > > if the source is mufile.log (by mathing the facility you set for > example) throw the log away (the ~ action) > > write to /var/log/messages > > 2. you can use rulesets, where you have one ruleset for all your > normal logs that both writes to /var/log/messages and sends remotely, and a > second ruleset that just sends remotely. > > David Lang > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
