linux – I want to forward log messages to a Syslog server

Question: Question:

There are multiple programs that output the log, and the output to the log does not use his Syslog and adds the result to a normal text file. How can I transfer these log files to a Syslog server?

Each program is written in the following languages.

  • Java
  • Perl
  • Ruby

In the server environment, CentOS6, 7, RHEL6 are mixed and output on each local disk. The following is an example, but there are about 50 physical and virtual units in total.

(example)

  • CentOS6: /var/log/application.log
  • CentOS7: /var/log/appname/system.log
  • RHEL6: /opt/app/logs/error.log

The Syslog server is running Syslog-ng on his RHEL6.

postscript

In addition, since each log file outputs errors, debugs, and warnings in the format of the output program, it is ideal that conditions can be specified for each local log and Syslog can be output at the Error, Warning, Debug, and Info levels.

Answer: Answer:

To write the contents of a file to syslog, assuming that a remote syslog transfer is possible from the syslog client

logger -f /var/log/application.log

or

tail -f /var/log/application.log | logger

postscript:

I wrote the answer on the assumption that the application cannot be changed, but if you do it properly, it is naturally better to write it directly to syslog for each Java, Perl, Ruby application. Java would be using log4j, so you should be able to just change the properties. The following setting example.

# configure the root logger
log4j.rootLogger=INFO, SYSLOG


# configure Syslog facility LOCAL1 appender
log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
log4j.appender.SYSLOG.threshold=WARN
log4j.appender.SYSLOG.syslogHost=localhost
log4j.appender.SYSLOG.facility=LOCAL4
log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
log4j.appender.SYSLOG.layout.conversionPattern=[%p] %c:%L - %m%n

Perl and Ruby should have settings if you are using the logger module as well. You can also write to syslog with a standard logging module in Python.

Serpentine

By the way, rsyslogd is not recommended as a syslog implementation. When writing to the local rsyslog, it is attractive that SSL / TLS can be used, such as temporarily saving to the local file system when the remote syslog is down, but it hangs under heavy load due to some bugs. Up.

Post Views: 7
Scroll to Top