Collect log from beginning incase central server's log file gets deleted.
Hi, Below is my setup (see the config details). Issue i am facing is : Lets say on central servers apache logs are collected till 2:00 PM for current date. Incase if i delete the log file on central server, a new file gets created and starts collecting the log after the delete time ie 2:00 PM. What i want to achieve is that in such an event where the log files gets deleted.. the new log-file will collect the log from the beginning of the day ie 12:00 AM. Is this possible ? *************** client config *********************** @include "scl.conf" options { keep_hostname(yes); log_fifo_size(100000) }; rewrite r_setfilename { set( "$FILE_NAME", value(".SDATA.file@18372.4.name") ); }; rewrite r_apache_basepath_www-dev01 { subst( "/apps/log/apache/www-dev01/", "", value(".SDATA.file@18372.4.name") type("string") flags("prefix") ); }; source s_apache_www-dev01 { file("/apps/log/apache/www-dev01/*.log" program_override("apache/www/dev01") flags(no-parse) recursive(yes) ); }; destination d_server { syslog("x.x.x.x" transport("tcp") port(514)); }; log { source(s_apache_www-dev01); rewrite(r_setfilename); rewrite(r_apache_basepath_www-dev01); destination(d_server); }; *************** Server Config ************ @include "scl.conf" options { create_dirs (yes); dir_perm(0755); dir_group(60030); dir_owner(wwwtools); perm(0755); owner(wwwtools); group(60030); keep_hostname(yes); threaded(yes); log_msg_size(5000000); }; source s_network { syslog(ip(0.0.0.0) port(514) transport("tcp") max-connections(200)); }; filter f_apache_www-dev01 { program('apache/www/dev01'); }; destination d_central { file("/apps/log/syslog-ng/${PROGRAM}/${YEAR}${MONTH}${DAY}/${HOST}/${. SDATA.file@18372.4.name}" template("${MSGONLY}\n") ); }; log { source(s_network); filter(f_apache_www-dev01); destination(d_central); }; -- Regards, Sagar Naravane
----- Original message -----
Hi,
Below is my setup (see the config details). Issue i am facing is :
Lets say on central servers apache logs are collected till 2:00 PM for current date. Incase if i delete the log file on central server, a new file gets created and starts collecting the log after the delete time ie 2:00 PM. What i want to achieve is that in such an event where the log files gets deleted.. the new log-file will collect the log from the beginning of the day ie 12:00 AM. Is this possible ?
no, syslog-ng is not file based, it is tailing logfiles and reads messages one by one. the server stores these messages in its configured destinations. the source and destination files are only connected through the configurations of the client and server. thus syslog-ng has no way of knowing whether a file was deleted or not. using rsync might be an option though.
I would like to filter several hosts that I don't want sending their logs to my syslog-ng I have this hostnames: initiator Use mpt0 NVDATA Rev gconfd Service I would like to filter those above host from sending logs to my syslog-ng. How can I do that? Thanks Francis Francis Yakin Sr. Unix System Engineer Kaiser Permanente Division Of Research 2000 Broadway ave Oakland, CA 94612 (510) 891-3873 (office) 8-481-3873 (tie-line) --------- kp.org/thrive
perhaps by using a host() filter? ----- Original message -----
I would like to filter several hosts that I don't want sending their logs to my syslog-ng
I have this hostnames:
initiator Use mpt0 NVDATA Rev gconfd Service
I would like to filter those above host from sending logs to my syslog-ng.
How can I do that?
Thanks
Francis
Francis Yakin Sr. Unix System Engineer Kaiser Permanente Division Of Research 2000 Broadway ave Oakland, CA 94612 (510) 891-3873 (office) 8-481-3873 (tie-line) --------- kp.org/thrive
participants (3)
-
Balazs Scheidler
-
Francis.T.Yakiin＠kp.org
-
sagar naravane