Hi Barry, I assume somewhere in your rsyslog.conf you have something in the lines of:
*.* /var/log/messages Which will put everything there. If you need the log lines slurped from the file to end up on the remote server only, the most elegant way is to use rulesets: http://www.rsyslog.com/doc/multi_ruleset.html This means you'll bind the imfile input to a ruleset, and send all logs from that ruleset to the remote server. Your local logs (default ruleset) will have nothing to do with this flow. I hope this helps. If it doesn't, please provide your rsyslog version and config file. Best regards, Radu On Sun, Apr 6, 2014 at 8:59 AM, Barry Haycock <[email protected]>wrote: > > > Is it possible to monitor a log file (non syslog) and have the data sent > to the remote host only. > > Currently I am monitoring a log file created by a script and the data from > the log file is ending up in /var/log/messages on the local server, there > is no need for it to be logged there, it should hopefully only be collected > on the remote server > -- > > Barry > > Banpen Fugyou - 10,000 Changes, No surprises > > > > ---------------------------------------------------------------- > This message was sent using IMP, the Internet Messaging Program. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
