[Chugalug] rsyslog - monitoring a file

Nick Smith nick at nicksmith.us
Tue Jun 25 02:05:20 UTC 2013


Does anyone have experience monitoring one off files with rsyslog and
sending them to a remote server?

I created a new conf file in /etc/rsyslog.d/ (ubuntu 12.04)
60-fileblah.conf

I have this in the file:

$ModLoad imfile
# File to Monitor
$InputFileName /file/to/monitor/server.log
$InputFileTag FileNameMonitor:
$InputFileStateFile /var/spool/rsyslog/statefile1
$InputFileSeverity info
$InputFileFacility local0
$InputRunFileMonitor
$InputFilePollInterval 10
*.* @syslog.server.ip

>From what ive read you need to change this line in the rsyslog.conf file:

$PrivDropToGroup adm (was syslog)

So if i have this right, it should poll that file every 10 seconds and send
the output to my syslog server IP over udp.

The problem is its not :\
I see other output from rsyslog on my log server, but nothing from this
file.

Anyone have any advice?
(ive restarted the rsyslog service and rebooted the whole box.)
I get no errors when i restart the service.

I was pulling that information from these sites:
http://www.rsyslog.com/doc/imfile.html
http://loggly.com/support/sending-data/logging-from/syslog/rsyslog/#configuring_rsyslog_for_file_monitoring

Thanks for any help.


-- 
--------------
Nick Smith
nick at nicksmith dot us
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://chugalug.org/pipermail/chugalug/attachments/20130624/071495c2/attachment.html>


More information about the Chugalug mailing list