[rsyslog] local/remote logging

Rainer Gerhards rgerhards at hq.adiscon.com
Wed Mar 5 19:16:18 CET 2008


Hi Johnn,

On Wed, 2008-03-05 at 19:49 -0500, Johnny Tan wrote:
> I want to have logs written locally (the way they usually 
> are) as well as sent to a central logger.
> 
> The two situations that I want local logs for are:
> 
> 1) in case the central logger is not available for any 
> reason, I don't lose messages

You don't need to lose message when the remote host is unavailable. Use
queued mode. This is currently documented for the database, but works
for any other action as well:

http://www.rsyslog.com/doc-rsyslog_high_database_rate.html

> 
> 2) if I need to troubleshoot something, I can just look at 
> the local logs
> 
> Obviously, I will rotate the local logs and have older ones 
> discarded. Whereas the central logger will archive them for 
> longer periods.
> 
> 
> Can I accomplish this with rsyslog? AIUI, I can, and I have 
> to move to at least v3.11.x -- is that correct?

Indeed. But don't use anything earlier than 3.12.0 - if you do, you'll
run into a couple of bugs.

> Assuming yes, I already got the remote logging working. What 
> do I do to get the simultaneous local logging to work too?

Rsyslog carries out whatever you configure. So just add a rule for local
logging, e.g.

*.* -/var/log/local-logfile

That's it ;)


> I can't find any wiki or faq on this. If I get it working, 
> I'd be happy to post it on the site.

That would be much appreciated!

HTH
Rainer




More information about the rsyslog mailing list