[rsyslog-notify] Forum Thread: Re: no logging on client please - (Mode 'reply')

[noreply at adiscon.com]

User: usaims 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26498#p26498

Message: 
----------
I'm back -- thank you.

My objective is to learn how to send the client's /var/log/messages or any
log file specified in the config file to log only to the remote centralized
rsyslog server.

When the sending system has these lines enabled in the /etc/rsyslog.conf
file, it logs naturally on the sending system.

[code:txjlmwym]$ModLoad        imuxsock # provides support for local system
logging
$ModLoad        imklog   # provides kernel logging support (previously done
by rklogd)
$ModLoad        immark   # provides --MARK-- message capability
$ModLoad        imfile
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$InputFileName /var/log/httpd/error_log
$InputFileTag apache-errors:
$InputFileStateFile stat-apache-error
$InputFileSeverity error
$InputRunFileMonitor
$InputFilePollInterval 10
*.info;*.!warn;\
        authpriv.none;cron.none;mail.none;news.none 
/var/log/messages
authpriv.*                                             
-/var/log/secure
*.emerg                                                
:omusrmsg:*
*.* @192.168.10.4[/code:txjlmwym]

When I put the the pound sign in front of these two lines and restart
rsyslog, it stops logging to /var/log/messages on the sending system.

[code:txjlmwym]#*.info;*.!warn;\
#       authpriv.none;cron.none;mail.none;news.none 
/var/log/messages
[/code:txjlmwym]

But I don't see messages file on the remote rsyslogd server.

When I do

[code:txjlmwym]rsyslogd -N1[/code:txjlmwym]

on the sending system, I get.

[code:txjlmwym]rsyslogd: version 8.17.0, config validation run
(level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.[/code:txjlmwym]

When I do

[code:txjlmwym]rsyslogd -N1[/code:txjlmwym]

on the remote syslog receiving server I get.

[code:txjlmwym]rsyslogd: version 8.17.0, config validation run
(level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.[/code:txjlmwym]

Here is my rsyslog.conf from the remote syslog receiving server.

[code:txjlmwym]$ModLoad imuxsock # provides support for local system
logging
$ModLoad imklog   # provides kernel logging support (previously done by
rklogd)
$ModLoad immark   # provides --MARK-- message capability
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
*.info;*.!warn;\
        authpriv.none;cron.none;mail.none;news.none    
-/var/log/messages
*.warn;\
        authpriv.none;cron.none;mail.none;news.none    
-/var/log/syslog
*.=debug                                                -/var/log/debug
authpriv.*                                             
-/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                 
-/var/log/maillog
*.emerg                                                
:omusrmsg:*
uucp,news.crit                                         
-/var/log/spooler
$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%" 
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%" 
authpriv.*   ?TmplAuth
*.info,mail.none,authpriv.none,cron.none  
?TmplMsg[/code:txjlmwym]

Thank you in advance for any help.