On Fri, 5 Apr 2013, Josh Bitto wrote:
I'm having a problem with how the output is happening. Its filling up my
messages file with repetitive information.
you need to explain the problem a bit more
1. what are you seeing
2. what do you expect to see
Should my /etc/rsyslog.d/forwardFile.conf look like this?
$ModLoad imfile
# File 1
$InputFileName /var/log/mysqld.log
$InputFileTag mysqld:
$InputFileStateFile stat-file1
$InputFileSeverity notice
$InputFileFacility local0
$InputRunFileMonitor
(no /etc/rsyslog.d/forwardRules.conf was set)
And to have this forwarded from a remote server to a central server. Should
there be a /etc/rsyslog.d/forwardRule.conf?
include files are completely optional.
I prefer not to use them, because it makes it harder to understand the
processing flow (especially if you discard messages at some point so that they
won't show up in the other log files)
I'm not quite sure how to put the forwarding rule in rsyslog.conf
If $programname == 'mysqld' then @forward.to.this.ip:514
I'm kinda confused about this....I don't know if mysqld.log (centos box) falls
under something that you have to monitor...or if I can just forward the file
that is created by the program to another server.
The first thing that you should be doing is making sure that rsyslog on the
mysql machine is seeing the logs. The best way to do this is to configure mysql
to log to syslog. If you can't do that, then using imfile to check the file
periodically and read new items from it is a distant second choice.
Once you are sure that you are getting the logs in syslog on the first machine,
then you can worry about getting them to a second machine and determining where
they go.
troubleshooting 101, start at the beginning and make sure things are working
each step of the way.
On my central syslog server the rsyslog.conf I want to use a template to
receive this data and put it in a file so
$template DYNmysqld,"/var/log/hosts/%HOSTNAME%/mysqld.log"
If \
$source != 'myhostname'\
And \
$programname == 'mysqld' \
Then ?DYNmysqld
Should this be working?
it depends on what the logs look like. If they are logs generated from the
imfile config above, I think they probably will, although I'll point out that
doing mixed case on commands "if" "and" "then" is highly questionable at best.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
