[rsyslog-notify] Forum Thread: Simply file forwarding - (Mode 'post')

[noreply at adiscon.com]

User: dumbIT 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25370#p25370

Message: 
----------
Hello, I am having trouble sending a file that I created to my remote
rsyslog server.  The server is fine and is receiving logs from other
clients on my network, so I am pretty sure it is my config that isn't
working.  I have a file that is generated weekly that I want sent to my
remote server.  When I restart my rsylsog, it sends the file to the remote
server, but it duplicates every line on the server end.  For example, here
is a piece of the file called weeklyReport.txt:

########################################################
####### Audit Report on :  schema01 #################
########################################################

DATE_TIME       USERNAME        OWNER           OBJ_NAME                   
   ACTION_NAME                  OS_USERNAME     USERHOST
--------------- --------------- ---------------
------------------------------ ---------------------------- ---------------
------------------------------
03142015:0000   schema_user  schema_user  mon_queue               EXECUTE
PROCEDURE            oracle          server01.domain.com
03142015:0000   schema_user  schema_user  mon_woker                     
SELECT                           oracle          server01.domain.com

on the rsyslog server, it will show up as:

Mar 23 17:32:51 server01 AuditReport
########################################################
Mar 23 17:32:51 server01 AuditReport
########################################################
Mar 23 17:32:51 server01 AuditReport ####### Audit Report on :  schema01
#################
Mar 23 17:32:51 server01 AuditReport ####### Audit Report on :  schema01
#################
Mar 23 17:32:51 server01 AuditReport
########################################################
Mar 23 17:32:51 server01 AuditReport
########################################################
Mar 23 17:32:51 server01 AuditReport DATE_TIME       USERNAME        OWNER 
         OBJ_NAME                       ACTION_NAME                 
OS_USERNAME     USERHOST
Mar 23 17:32:51 server01 AuditReport DATE_TIME       USERNAME        OWNER 
         OBJ_NAME                       ACTION_NAME                 
OS_USERNAME     USERHOST
Mar 23 17:32:51 server01 AuditReport --------------- ---------------
--------------- ------------------------------ ----------------------------
--------------- ------------------------------
Mar 23 17:32:51 server01 AuditReport --------------- ---------------
--------------- ------------------------------ ----------------------------
--------------- ------------------------------
etc...

This is my config on server01:

[code:1dw76ilm]$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog
# Provides support for local system logging (e.g. via logger
command)
$ModLoad imuxsock

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none               
/var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                 
-/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                         
/var/log/spooler

# Save boot messages also to boot.log
local7.*                                               
/var/log/boot.log
*.* @server01

$ModLoad imfile

$InputFileName /home/user/weeklyReport.txt
$InputFileTag AuditReport
#$InputFileStateFile AuditReport
$InputFileSeverity info
#$InputFilePersistStateInterval 60
$InputRunFileMonitor
$InputFileFacility local5

$template AuditReport,"%timestamp:::date-rfc3164% %HOSTNAME%\n"
if $programname == 'AuditReport' then @rsyslogserver01
if $programname == 'AuditReport' then ~[/code:1dw76ilm]

I'm not sure what am I missing or overlooking here.  The restart of rsyslog
looks fine and even outputs the file fine in /var/log/messages.

The second thing is that I want to send out more than one file as well, but
the rsyslog seems to cut off part of the second file, but i first would
like to get the top resolved first.  Many thanks in advance for your help
or pointing me in the right direction.