you would have to direct your journald questions at the systemd developers, my
expectation is that they won't have answers for you. Journald isn't designed to
deal with more than one machine.
I think the best thing to do is to get the logs out of the journal into rsyslog,
and then pretend the journal doesn't exist.
I dom't know what you think you will be achieving by outputting the messages
from rsyslog into journald.
David Lang
On Tue, 20 Jan 2015, Brendan Kearney wrote:
Date: Tue, 20 Jan 2015 15:45:41 -0500
From: Brendan Kearney <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: [rsyslog] rsyslog, journald and phplogcon
hello,
i have an older envirionment that predates journald, where rsyslog-relp
is used to forward all rsyslog messages to a specific host and then
ommysql puts the messages into a database. i then have phplogcon attach
to the database and provide a web interface to the logs. this is a
great setup for me and has been working for some time.
i am now in the process of updating many of my systems and journald is
changing things. it looks like i can use omjournal to send the journal
messages to a central device, but i am not sure if the reliable part of
relp is built into omjournal. i would assume not. can omjournal and
omrelp be used together to provide reliable transmission of journald
messages to a central device? i also find that imuxsocks can be used.
what are other people doing?
once i get messages to the central device, how does one get journald
messages into mysql for phplogcon to be used? currently, i have the
below config, but it does not insert records into the database.
clearly, i am missing something. could you point me in the correct
direction?
module(load="imuxsock")
module(load="imjournal")
module(load="imklog")
#module(load="immark")
# Provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")
# Provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
# Provides RELP reception
module(load="imrelp")
input(type="imrelp" port="20514")
# Load MySQL support
module(load="ommysql")
# MASSIVE INSERT RATE FOR DB / SCALED DB LOGGING
$WorkDirectory /var/spool/rsyslog # default location for work files
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName dbq # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File to store the position in the journal
$IMJournalStateFile imjournal.state
#### RULES ####
if ( $inputname == 'imudp' or $inputname == 'imtcp' or $inputname ==
'imrelp' )
then
action(type="ommysql" server="server1.bpk2.com" serverport="3306"
db="Syslog" uid="syslog" pwd="syslog")
& stop
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
