[rsyslog-notify] Forum Thread: Re: no logging on client please - (Mode 'reply')

[noreply at adiscon.com]

User: usaims 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26473#p26473

Message: 
----------
To clarify my issue:

I want my clients not to store logs locally -- I want all logging on a
remote logging server only.

When I comment in the lines for /var/log/messages on the client's
rsyslog.conf and restart rsyslog -- it stops writing locally (good) but
does NOT write to remote server (bad).
   ##  *.info;*.!warn;\
   ##        authpriv.none;cron.none;mail.none;news.none  /var/log/messages

I need it to write to remote server only but it is not -- I suspect it is
the rsyslog.conf on the remote server is the problem.

This is what I have on remote server rsyslog.conf file:

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by
rklogd)
$ModLoad immark   # provides --MARK-- message capability
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
*.info;*.!warn;\
        authpriv.none;cron.none;mail.none;news.none     -/var/log/messages
*.warn;\
        authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog
*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          -/var/log/spooler

$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%" 
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%" 

authpriv.*   ?TmplAuth
*.info,mail.none,authpriv.none,cron.none   ?TmplMsg
####################

This is what I have in my client rsyslog.conf
root at nys-node2:/etc# egrep -v '(^#|^ )' rsyslog.conf

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by
rklogd)
$ModLoad immark   # provides --MARK-- message capability
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3

$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$ModLoad imfile
$InputFileName /var/log/httpd/access_log combined
$InputFileTag apache-access:
$InputFIleStateFile stat-apache-access
$InputFileSeverity info
$InputRunFileMonitor

$ModeLoad imfile
$InputFileName /var/log/httpd/error_log
$InputFileTag apache-errors:
$InputFileStateFile stat-apache-error
$InputFileSeverity error
$InputRunFileMonitor

$InputFilePollInterval 10

###############
#### RULES ####
###############
# Uncomment this to see kernel messages on the console.
#kern.*                                                 /dev/console

# Log anything 'info' or higher, but lower than 'warn'.
# Exclude authpriv, cron, mail, and news.  These are logged elsewhere.
#*.info;*.!warn;\
#      authpriv.none;cron.none;mail.none;news.none  /var/log/messages

# Log anything 'warn' or higher.
# Exclude authpriv, cron, mail, and news.  These are logged elsewhere.
#*.warn;\
#       authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

# Debugging information is logged here.
#@*.=debug                                              -/var/log/debug

# Private authentication message logging:
#authpriv.*                                             -/var/log/secure

# Cron related logs:
#cron.*                                                 -/var/log/cron

# Mail related logs:
#mail.*                                                 -/var/log/maillog

# Emergency level messages go to all users:
*.emerg                                                 :omusrmsg:*

# This log is for news and uucp errors:
#uucp,news.crit                                         -/var/log/spooler


# Send to centralized server:
*.* @192.168.10.4