2015-01-21 6:25 GMT+01:00 David Lang <[email protected]>: > you would have to direct your journald questions at the systemd > developers, my expectation is that they won't have answers for you. > Journald isn't designed to deal with more than one machine. > > I think the best thing to do is to get the logs out of the journal into > rsyslog, and then pretend the journal doesn't exist. > > I dom't know what you think you will be achieving by outputting the > messages from rsyslog into journald. > > I guess Brendan is just confused by the options. If so, this presentation may help to clear the mind up:
http://www.slideshare.net/rainergerhards1/rsyslog-vs-systemd-journal-presentation The module use starts at slide 17, I think. But I'd recommend to have at least a glance at the whole presentation. HTH Rainer > David Lang > > On Tue, 20 Jan 2015, Brendan Kearney wrote: > > Date: Tue, 20 Jan 2015 15:45:41 -0500 >> From: Brendan Kearney <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: [email protected] >> Subject: [rsyslog] rsyslog, journald and phplogcon >> >> >> hello, >> >> i have an older envirionment that predates journald, where rsyslog-relp >> is used to forward all rsyslog messages to a specific host and then >> ommysql puts the messages into a database. i then have phplogcon attach >> to the database and provide a web interface to the logs. this is a >> great setup for me and has been working for some time. >> >> i am now in the process of updating many of my systems and journald is >> changing things. it looks like i can use omjournal to send the journal >> messages to a central device, but i am not sure if the reliable part of >> relp is built into omjournal. i would assume not. can omjournal and >> omrelp be used together to provide reliable transmission of journald >> messages to a central device? i also find that imuxsocks can be used. >> what are other people doing? >> >> once i get messages to the central device, how does one get journald >> messages into mysql for phplogcon to be used? currently, i have the >> below config, but it does not insert records into the database. >> clearly, i am missing something. could you point me in the correct >> direction? >> >> module(load="imuxsock") >> module(load="imjournal") >> module(load="imklog") >> #module(load="immark") >> >> # Provides UDP syslog reception >> module(load="imudp") >> input(type="imudp" port="514") >> >> # Provides TCP syslog reception >> module(load="imtcp") >> input(type="imtcp" port="514") >> >> # Provides RELP reception >> module(load="imrelp") >> input(type="imrelp" port="20514") >> >> # Load MySQL support >> module(load="ommysql") >> >> # MASSIVE INSERT RATE FOR DB / SCALED DB LOGGING >> $WorkDirectory /var/spool/rsyslog # default location for work files >> $ActionQueueType LinkedList # use asynchronous processing >> $ActionQueueFileName dbq # set file name, also enables disk mode >> $ActionResumeRetryCount -1 # infinite retries on insert failure >> >> # Use default timestamp format >> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat >> >> # File to store the position in the journal >> $IMJournalStateFile imjournal.state >> >> #### RULES #### >> >> if ( $inputname == 'imudp' or $inputname == 'imtcp' or $inputname == >> 'imrelp' ) >> then >> action(type="ommysql" server="server1.bpk2.com" serverport="3306" >> db="Syslog" uid="syslog" pwd="syslog") >> & stop >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
