Re: [rsyslog] Can a single logfile be part of multiple imfile configs?

[deoren]

On 1/26/2018 5:44 PM, Scot Kreienkamp wrote:



Scot Kreienkamp |Senior Systems Engineer | La-Z-Boy Corporate
One La-Z-Boy Drive| Monroe, Michigan 48162 |  Office: 734-384-6403 |  |  
Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com

-Original Message-
From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of
deoren
Sent: Friday, January 26, 2018 4:36 PM
To: rsyslog@lists.adiscon.com
Subject: Re: [rsyslog] Can a single logfile be part of multiple imfile configs?

On 1/26/2018 3:29 PM, Scot Kreienkamp wrote:

Hi everyone,

My basic question: Can the same logfile be used in two imfile inputs?



There may be other ways of doing this, but this comes to mind:




There are other ways of doing it, and I know another way that would work better.  


Alright. Good luck to you and please share if/when you get a final answer.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Can a single logfile be part of multiple imfile configs?

[Scot Kreienkamp]

Scot Kreienkamp |Senior Systems Engineer | La-Z-Boy Corporate
One La-Z-Boy Drive| Monroe, Michigan 48162 |  Office: 734-384-6403 |  |  
Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com
> -Original Message-
> From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of
> deoren
> Sent: Friday, January 26, 2018 4:36 PM
> To: rsyslog@lists.adiscon.com
> Subject: Re: [rsyslog] Can a single logfile be part of multiple imfile 
> configs?
>
> On 1/26/2018 3:29 PM, Scot Kreienkamp wrote:
> > Hi everyone,
> >
> > My basic question: Can the same logfile be used in two imfile inputs?
>
>
> There may be other ways of doing this, but this comes to mind:



There are other ways of doing it, and I know another way that would work 
better.  This config is driven through puppet and that's the current structure. 
 Right now I'm just trying to understand why it's not working so I know how to 
refactor the puppet module.  I don't want to make any wrong assumptions, quite 
possibly like I already did.

This message is intended only for the individual or entity to which it is 
addressed.  It may contain privileged, confidential information which is exempt 
from disclosure under applicable laws.  If you are not the intended recipient, 
you are strictly prohibited from disseminating or distributing this information 
(other than to the intended recipient) or copying this information.  If you 
have received this communication in error, please notify us immediately by 
e-mail or by telephone at the above number. Thank you.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Can a single logfile be part of multiple imfile configs?

[deoren]

On 1/26/2018 3:29 PM, Scot Kreienkamp wrote:

Hi everyone,

My basic question: Can the same logfile be used in two imfile inputs?



There may be other ways of doing this, but this comes to mind:

1. A single input object which specifies the file you want to monitor.
2. Attach a single ruleset to the input
3. Inside the ruleset, call two other rulesets

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

[rsyslog] Can a single logfile be part of multiple imfile configs?

[Scot Kreienkamp]

Hi everyone,

My basic question: Can the same logfile be used in two imfile inputs?

I have a single logfile that I need to send to a two distinct destinations.  
The config is stored in a single file, so I just duplicated that file and 
changed the naming of the rules and stuff in it so there would be no collision. 
 This resulted in two paragraphs like so (for brevity, I removed the actual 
ruleset being called):


input(type="imfile"

file="/opt/oracle/domains/py/soa_domain/mserver/soa_domain/servers/vm_bam_server1/logs/vm_bam_server1.out"
tag="rslog_soapy1_bam1out:"
facility="local6"
PersistStateInterval="100"
ruleset="Rule-splunk_soapy1_bam1out"
reopenOnTruncate="on"
)

input(type="imfile"

file="/opt/oracle/domains/py/soa_domain/mserver/soa_domain/servers/vm_bam_server1/logs/vm_bam_server1.out"
tag="rslog_soapy1_bam1out:"
facility="local6"
PersistStateInterval="100"
ruleset="Rule-rslog_soapy1_bam1out"
reopenOnTruncate="on"
)


What I'm seeing is that the content is not being sent to the second 
destination.  So does this mean that a logfile can only be used in a single 
imfile input?

Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate
One La-Z-Boy Drive | Monroe, Michigan 48162  | * 734-384-6403 | | * 7349151444 
| *  scot.kreienk...@la-z-boy.com
www.la-z-boy.com | 
facebook.com/lazboy
 | twitter.com/lazboy | 
youtube.com/lazboy

[cid:lzbVertical_hres.jpg]



This message is intended only for the individual or entity to which it is 
addressed.  It may contain privileged, confidential information which is exempt 
from disclosure under applicable laws.  If you are not the intended recipient, 
you are strictly prohibited from disseminating or distributing this information 
(other than to the intended recipient) or copying this information.  If you 
have received this communication in error, please notify us immediately by 
e-mail or by telephone at the above number. Thank you.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.