Hello, <div><br></div><div>The wildcard file source was introduced in thr 3.10 version. Please try at least that version. </div><div><br></div><div>The latest syslog-ng version is 3.14.</div><div><br></div><div>--</div><div>Kokan<br><br><div class="gmail_quote"><div dir="ltr">On Thu, 12 Apr 2018, 1:22 am Eric Anderson, <<a href="mailto:eric.anderson@stonecroptech.com">eric.anderson@stonecroptech.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-4850869035402681656WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Im trying to use the wildcard-file module, but the syslog-ng Module: wildcard-file is missing<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"># service syslog-ng start<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Error parsing source, source plugin wildcard-file not found in /etc/syslog-ng/conf.d/export-client.conf at line 4, column 29:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> included from /etc/syslog-ng/syslog-ng.conf line 71, column 1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">source s_export_recursive { wildcard-file(<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ^^^^^^^^^^^^^<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I upgraded to the latest syslog-ng
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"># syslog-ng -V<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">syslog-ng 3.9.1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Installer-Version: 3.9.1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Revision: <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Module-Directory: //usr/lib64/syslog-ng<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Module-Path: //usr/lib64/syslog-ng<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Available-Modules: kvformat,afprog,afsocket,basicfuncs,linux-kmsg-format,graphite,cef,curl,add-contextual-data,date,json-plugin,pseudofile,afstomp,dbparser,confgen,cryptofuncs,syslogformat,disk-buffer,afuser,afamqp,csvparser,affile,system-source<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Enable-Debug: off<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Enable-GProf: off<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Enable-Memtrace: off<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Enable-IPv6: on<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Enable-Spoof-Source: off<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Enable-TCP-Wrapper: on<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Enable-Linux-Caps: on<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">But I still don’t see where the wildcard-file is.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">What Im missing to enable the wildcard-file module?<u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The conf file Ive created where I want to use it looks like this:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"># syslog-ng conf file for central logging CLIENT: export<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">#<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"># export source<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">source s_export_recursive { wildcard-file(<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> base-dir("/var/www/capstan/shared/log/exports/")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> filename-pattern("*.log")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> recursive(yes)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> follow-freq(1)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> flags(no-parse)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> log-fetch-limit(100)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ); };<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"># export destination<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">destination d_export_app1 { tcp(10.0.32.97 port(601)); };<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"># export log<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">log { source(s_export_recursive); destination(d_export_app1); };<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Times New Roman"">Eric Anderson</span></b><span style="font-family:"Times New Roman""> | DevOps Engineer<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Times New Roman"">E: <a href="mailto:michaelg@stonecroptech.com" target="_blank">
<span style="color:#0563c1">eric.anderson@stonecroptech.com</span></a> | O: 212.500.2017 | M: 650.743.4598<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Times New Roman""><img border="0" width="145" height="46" id="i162b7fe31574cff311" src="cid:162b7fe31574cff311" class="nativeView" style="width: 329px;"></span><u></u><u></u></p>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div></div>