Search code examples
syslogrsyslog

How to forward logs using rsyslog client

I need to forward messages from a log file to another IP - let's say 127.0.0.1 514. How do I achieve this?

I used this example from the docs of rsyslog:

module(load="imfile" PollingInterval="10") #needs to be done just once



# File 2
input(type="imfile"
     File="/path/to/file2"
     Tag="tag2")

As well as providing it with the following rule:

*.*      @127.0.0.1:514

But this ended up sending all of the system's logs including journald.

So how do I correctly use ruleset, input blocks and *.* @127.0.0.1:514 to send logs from file /path/to/file2 to 127.0.0.1:514?

Thanks

Solution

  • When specifying the input, also say which ruleset to apply. Input outside the ruleset will not be processed by the ruleset.

    module(load="imfile")
input(type="imfile" File="/path/to/file2" Tag="tag2" ruleset="remote")
ruleset(name="remote"){
 action(type="omfwd" target="127.0.0.1" port="514" protocol="udp")
 # or use legacy syntax:
 # *.*  @127.0.0.1:514
}