CODEWITHSUNDEEP
linuxloggingsyslogrsyslog
landy
landy

Reputation: 91

rsyslog , collect log from files outside /var/log

I have different logs that are written to our moutend nfs share that i need to send to our syslog-server (graylog) they are located outside /var/log folder. So i add some extra conf in /etc/rsyslog.d/ For this example i have two files with following config:

atlassian-application-confluence-log.conf

module(load="imfile")
module(load="imklog")
$MaxMessageSize 50k
global(workDirectory="/atlassian/test/confluence/logs")

# This is the main application log file
input(type="imfile"
File="/atlassian/test/confluence/logs/atlassian-confluence.log"
Tag="atlassian"
PersistStateInterval="200"
)

# This file contains entries related to the search index.
input(type="imfile"
File="/atlassian/test/confluence/logs/atlassian-confluence-index.log"
Tag="atlassian"
PersistStateInterval="200"
)

# Send to Graylog
action(type="omfwd" target="log-server-company.com" port="5140")

# if you want to keep a local copy of the logs.
action(type="omfile" File="/var/log/rsyslog.log" template="RSYSLOG_TraditionalFileFormat")

atlassian-application-jira-log.conf

module(load="imfile")
module(load="imklog")
$MaxMessageSize 50k

global(workDirectory="/atlassian/test/jira/log")

# Contains logging for most of Jira, including logs that aren’t specifically written elsewhere
input(type="imfile"
File="/atlassian/test/jira/log/atlassian-jira.log"
Tag="atlassian"
PersistStateInterval="200"
)

# Send to Graylog
action(type="omfwd" target="log-server-company.com" port="5140")

# if you want to keep a local copy of the logs.
action(type="omfile" File="/var/log/rsyslog.log" template="RSYSLOG_TraditionalFileFormat")

So to my problem. When i check the Rsyslogd configuration with following command: rsyslogd -N1 -f /etc/rsyslog.d/atlassian-application-confluence-log.conf It says it is valid.
When i restart the rsyslog service i get the following errors:

module 'imfile' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]
module 'imklog' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]

error during parsing file /etc/rsyslog.d/atlassian-tomcat-confluence-log.conf, on or before line 6: parameter 'workdirectory' specified more than once - one instance is ignored. Fix config [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2207]>
error during parsing file /etc/rsyslog.d/atlassian-tomcat-confluence-log.conf, on or before line 6: parameter 'workDirectory' not known -- typo in config file? [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2207] 

module 'imfile' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]
module 'imklog' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]
[origin software="rsyslogd" swVersion="8.2102.0-10.el8" x-pid="379288" x-info="https://www.rsyslog.com"] start
imjournal: journal files changed, reloading...  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/0 ]

How can i get rid of the warnings? I have already tried to put the two modules in /etc/rsyslog.conf

I get following errors from that config: parameter 'PersistStateInterval' not known parameter 'Tag' not known parameter 'File' not known

Upvotes: 0

Views: 1117

Answers (1)

eDonkey
eDonkey

Reputation: 717

If there are multiple configuration files, they are processed in ascending sort order of the file name (numerically/alphabetically), See: $IncludeConfig.

Therefore you don't have to include any configuration parameters (modules, work directories, rulesets etc.) multiple times. You can include them once in the config which is loaded first.

Upvotes: 0

Related Questions