[syslog-ng] Example 3.4. Script to feed a growing logfile into syslog-ng

[Chris Pratt]

Thanks for your suggestion.  This is for Tomcat.  Unfortunately I am
stuck reading from the log because the syslog appender in the log4j
version on our app does not capture stack traces while the file
appenders do.  In other cases we want to capture garbage collections
which are only written to stdout.  I tried sending my file appends to
/dev/log but that didn't work so I am stuck trying to read from files. 
Only my central log server runs syslog-ng.  All of my Tomcat hosts just
use syslogd and send *.* @mylogserver.  Otherwise I'd probably try #
source s_tail { file("log.log" follow_freq(1) flags(no-parse)); }; to
see if it kept it in order any better.

What I could really use is a logger that has the ability to read and
forward to syslog the existing timestamp...


Carlos Carvalho wrote:
> Chris Pratt (pratt70 at gmail.com) wrote on 24 July 2008 13:10:
>  >Followed http://www.syslog.org/syslog-ng/v2/#id2535001 and created some
>  >tail logger combos to feed some growing logfiles into syslog-ng. 
>  >
>  >Issue that I am need to get around is that while I haven't missed
>  >capturing any messages this way the time stamps in syslog-ng seem to be
>  >when logger actually gets the line into syslog rather than that of the
>  >tailed files line.  I have a very quick-filling file (logged 143
>  >messages yesterday all at 14:15:18) and when I view syslog-ng these are
>  >stamped up to 14:15:36 and no longer in any order.
>
> I suggest you make your disk-eater write to a fifo, and syslog-ng read
> from it with a pipe source. I do it for apache...
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>