rsyslog 5.8 imfile outside /var/log not picking up log files

Question

I would like to pick up logs of different types from various locations other than /var/log and send them to a central location.

Using RH 6.6 and rsyslog 5.8 the configuration works fine when using path within /var/log. If I use other path like /opt/appname/log/file.log. The rsyslog client does not pick up the log. I do not see any error or message when running rsyslogd in debug mode.

Example: Client:

   ...
   $InputFileName /opt/appname/test.log
   $InputFileTag APPNAME1
   $InputFileStateFile stat-APPNAME1
   $InputFileSeverity info
   $InputFilePersistStateInterval 200
   $InputFileFacility local3 # alto tried with other local
   $InputRunFileMonitor
   ...

Server:

   ...
   $template HostAudit, "/opt/logs/%HOSTNAME%/test.log"  # tried differnt path
   $template auditFormat, "%msg%\n"
   local3.*                                ?HostAudit;auditFormat
   ...

Any recommendations?, I appreciate your help!!!

Bill

If you've run rsyslog in debug mode, is it safe to assume you've also run rsyslog -N 1 to verify the syntax of your config files? — StockB

Sean Sean · Accepted Answer · 2018-08-30T18:43:47

I would first try these:

Verify that the state file names are unique
Verify that every $InputFileName points to an existing regular file
Remove some of the files that you want to be monitored from the configuration. It could be that there is a problem with only one of the monitored files. That would make rsyslog ignore the rest of the files.

I had this with "$InputFileStateFile tomcat-log" for each of the individual tomcat logs. Each of the state file name needs to be unique. For me it worked by changing it to instances of:

"$InputFileStateFile tomcat-manager"
"$InputFileStateFile tomcat-localhost"

etc... Another option is to just add numbers to the end of the state file name.

"$InputFileStateFile tomcat-log1"
"$InputFileStateFile tomcat-log2"

rsyslog 5.8 imfile outside /var/log not picking up log files

1 Answers