I have the same setup. I have my central rsyslog server and splunk server on the same box. I'm having all clients send logs and having rsyslog put them in different log locations.
Then on the splunk side I'm just indexing those file locations. What method are you using to throw away all other logs? I've not heard of a sinkhole directory. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David Lang Sent: Wednesday, April 03, 2013 2:58 PM To: rsyslog-users Subject: Re: [rsyslog] Allocating certain logs to certain files What I do with splunk is that I have my clients send all the logs up to my central server, and Splunk server. I then have the rsyslog on the Splunk server write the logs that I want splunk to index into a file and then throw all the other logs away. I roll the log from where it's written into a splunk sinkhole directory once a minute. David Lang On Wed, 3 Apr 2013, Josh Bitto wrote: > Would these if then statements work for windows events? > > Basically here is my goal... > > I want to use splunk as a Management tool for my logs (free version is 500 mb > volume/24 hour period) ....but I want rsyslog to forward log files to my > central log server. > In order to stay under that 500mb limit for the whole network. I want to > determine what is an acceptable exclusion for indexing data from a file > source. The file source would be what you just helped me with. > > The coding that I had before made my log files for messages huge. > > So could you help me understand what $syslogseverity <= '6' means? > > I want to log the important stuff and exlude stuff that doesn't really matter > for both linux and windows logs. > > Note: the windows side will be much easier because there are applications > that allow you to send logs of whatever log file you want. The linux not so > much. > > > > > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Marcelo > Veglienzone > Sent: Wednesday, April 03, 2013 12:30 PM > To: rsyslog-users > Subject: Re: [rsyslog] Allocating certain logs to certain files > > In that case you only need one rule, something like this should work > > > 1. if \ > 2. $source != 'loghost.example.com' \ > 3. then *.* ?DYNlogfile > > > > > On Wed, Apr 3, 2013 at 4:23 PM, Josh Bitto <[email protected]> wrote: > >> Oh ok thank you! That worked! >> >> I'm sorry I keep asking questions.... >> >> So in the If, then statements where it says >> >> if \ >> $source != 'syslog.onlineschool.ca' \ >> and \ >> $syslogseverity <= '6' \ >> >> -------------------------------------------------------------- >> >> The very last line of the above $syslogseverity<= '6'\ >> >> Does this only log certain message types? Or if I wanted to have >> everything what would I put? >> >> (not a programmer) >> >> >> >> -----Original Message----- >> From: [email protected] [mailto: >> [email protected]] On Behalf Of Marcelo Veglienzone >> Sent: Wednesday, April 03, 2013 12:07 PM >> To: rsyslog-users >> Subject: Re: [rsyslog] Allocating certain logs to certain files >> >> loghost is the name of the machine doing the central logging with >> rsyslog which I want to keep it's logs under the default location >> >> $source != 'loghost.example.com' >> means every hosts but loghost.example.com >> >> >> On Wed, Apr 3, 2013 at 4:03 PM, Josh Bitto <[email protected]> wrote: >> >>> On your if, then statements where it says $source != ' >> loghost.example.com' >>> \ >>> >>> What would I replace it with? %hostname% >>> >>> The reason I ask is that there will be many host names or IP >>> addresses that I'm forwarding logs from. >>> >>> >>> >>> -----Original Message----- >>> From: [email protected] [mailto: >>> [email protected]] On Behalf Of Marcelo Veglienzone >>> Sent: Wednesday, April 03, 2013 11:47 AM >>> To: rsyslog-users >>> Subject: Re: [rsyslog] Allocating certain logs to certain files >>> >>> Josh, >>> >>> This is what I'm currently using, http://pastebin.com/tsTHdsZY >>> Starting at line 116 you'll find what you want >>> >>> >>> On Wed, Apr 3, 2013 at 3:38 PM, Josh Bitto <[email protected]> >> wrote: >>> >>>> Ok here is my issue...on my cental rsyslog server I have in my >>>> config file the following.... >>>> >>>> # This one is the template to generate the log filename >>>> dynamically, depending on the client's IP address. >>>> $template FILENAME,"/var/log/%fromhost-ip%/syslog.log" >>>> >>>> # Log all messages to the dynamically formed file. Now each clients >>>> log (192.168.1.2, 192.168.1.3,etc...), will be under a separate >>>> directory which is formed by the template FILENAME. >>>> *.* ?FILENAME >>>> >>>> >>>> That puts an output to my /var/log/<host IP>/syslog.log file. >>>> >>>> Essentially what I want is to have the same thing except separate >>>> files for each log file /Dev/console /var/log/messages >>>> /var/log/secure/ -/var/log/maillog /var/log/cron *.emerg >>>> /var/log/spooler /var/log/boot.log >>>> >>>> How would I add that to the config to make it happen? >>>> >>>> The other thing....I still can't get httpd logs from remote servers >>>> to forward to my central rsyslog server. >>>> >>>> Josh >>>> >>>> >>>> >>>> >>>> Joshua Bitto >>>> Information Technologist >>>> KCC >>>> >>>> >>>> >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >>>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >>>> you DON'T LIKE THAT. >>>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: >>> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >>> you DON'T LIKE THAT. >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: >> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> you DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This > is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our > control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
