[rsyslog-notify] Forum Thread: Re: Forwarding select hosts to remote host for analysis - (Mode 'reply')

[noreply at adiscon.com]

User: fmagee 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26815#p26815

Message: 
----------
Tried to attach the file but couldn't find an extension that was
acceptable. Here are the contents of the complete rsyslog.conf.

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see <!-- m --><a class="postlink"
href="http://www.rsyslog.com/doc/troubleshoot.html">http://www.rsyslog.com/doc/troubleshoot.html</a><!--
m -->

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via
logger command)
$ModLoad imklog   # provides kernel logging support (previously done by
rklogd)
$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Templates
# Set template to dynamically generate filename

# This is the original template directive
# $template FILENAME,"/syslog/%fromhost-ip%/messages"
# This is the new directive to hopefully write remote messages to the
/syslog directory only
# Modified 20160616 - fim


$template FILENAME,"/syslog/%fromhost-ip%/messages" *
*.* ?FILENAME
& ~

# Rules to divert remote messages to host specific message files

# Set template to dynamically generate filename
#
# $template FILENAME,"/syslog/%fromhost-ip%/messages"

*.* ?FILENAME


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
# *.info;mail.none;authpriv.none;cron.none             
@coalogman.coa.cabq.lcl

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
# authpriv.*                                             
@coalogman.coa.cabq.lcl

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron


# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

### begin forwarding rule ###
# Created this forwarding rule to send syslog messages to arcsightappl
server for analysis
# by the arcsight application. 20160711 - fim
#
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
# begin forwarding rule
$WorkDirectory /rsyslog/work # where to place spool files
$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList   # run asynchronously
$ActionResumeRetryCount -1    # infinite retries if host is down
*.* @@arcsightappl.cabq.gov:515
# end forwarding rule
# remote host is: arcsightappl.cabq.gov:515 # name/ip:port, e.g.
192.168.0.1:514, port optional
### end of the forwarding rule ###

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###