rsyslog conditional forwarding for remote logs de-formatting the date and time in the log file

Karn Kumar

I've another question about the conditional forwarding of logs via rsyslog.conf, i have below configuration.

# cat  /etc/rsyslog.conf
##########################################################################################
# rsyslog configuration file For TCC & TPC
##########################################################################################
#### MODULES ####
$ModLoad imuxsock        # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal       # provides access to the systemd journal
$ModLoad imudp           # Provides UDP syslog reception
$UDPServerRun 514        # Provides UDP syslog reception
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
$template tcc-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
$template noi-logs, "/data/noiter/%HOSTNAME%/messages.log"

#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
if $fromhost startswith "sj-" then -?tcc-logs
& stop

if $fromhost startswith "noi-" then -?noi-logs
& stop


##################################################
#### GLOBAL DIRECTIVES                        ####
#################################################
$WorkDirectory /var/lib/rsyslog                                 # Where to place auxiliary files
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat        # Use default timestamp format
$IncludeConfig /etc/rsyslog.d/*.conf                            # Include all config files in /etc/rsyslog.d/
$OmitLocalLogging on                                            # local messages are retrieved through imjournal now.
$IMJournalStateFile imjournal.state                             # File to store the position in the journal

#### RULES ############################################
# Log anything (except mail) of level info or higher.#
# Don't log private authentication messages!        #
####################################################
*.info;mail.none;authpriv.none;cron.none    ?tcc-logs
authpriv.*       ?tcc-logs                                      # The authpriv file has restricted access.

In the above configuration, i'm trying to ask rsyslog for conditional forwarding of logs with below points:

  1. If any upcoming host to rsyslog which startswith "sj" then it should go to "/data/SYSTEMS/ Directory " which will create another Directory with hostname and then will create a messages.log on this So, the complete file path will be like /data/SYSTEMS/sj-hosts_1/messages.log .

  2. Similarly, If any upcoming host to rsyslog which startswith noi- then it should go to /data/noiter/ Directory " which will create another Directory with hostname and then will create a messages.log on this So, the complete file path will be like /data/noiter/noi-hosts_1/messages.log .

The above two points meets the results However the problem is the messages.log in the above case creating the date and time into different format than the default, example is below:

2019-01-25T23:20:01-08:00 noi-hosts_1 CROND[8541]: (root) CMD (/usr/lib64/sa/sa1 1 1)

2019-01-25T23:20:01-08:00 noi-hosts_1 CROND[8542]: (root) CMD (LANG=C LC_ALL=C 

While the default & required format should be as follows:


Jan 25 20:23:58 noi-hosts_1 CROND[8541]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Jan 25 20:23:58 noi-hosts_1 CROND[8542]: (root) CMD (LANG=C LC_ALL=C 

Note:

When i don't use conditional forwarding then i used to get the correct /default one as shown above.

meuh

Your conditional rules if $fromhost ... are near the start of the configuration, and use the default logging style, which for rsyslog is now RSYSLOG_FileFormat. You change the default to the wanted RSYSLOG_TraditionalFileFormat later on, but this only applies to any following rules.

So simply move your conditional rules further down in the file, to just after the comment block #### RULES ...

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

rsyslog conditional forwarding for remote logs

From Dev

Rsyslog not forwarding specific log file to remote server

From Dev

Rsyslog not forwarding specific log file to remote server

From Dev

rsyslog not forwarding messages to remote rsyslog server

From Dev

rsyslog suppose to writing remote logs to a file by remote host name or ip address?

From Dev

Excel conditional formatting before and after time when date and time are mixed

From Dev

rsyslog only making log files in /var/logs

From Dev

Rsyslog outputting to custom log file

From Dev

rsyslog not writing dynamic log file

From Dev

Get rsyslog forwarding messages after remote server restart

From Dev

Get rsyslog forwarding messages after remote server restart

From Dev

configure rsyslog server to log incomming messages with time of the rsyslog server

From Dev

Using exec and tee to redirect logs to stdout and a log file in the same time

From Dev

Conditional Formatting using Date Comparison

From Dev

Excel Conditional Formatting for Date colums

From Dev

excel conditional formatting validate date

From Dev

Formatting date time in SSRS

From Dev

Formatting date and time in PowerShell

From Dev

Date Time Format is not Formatting

From Dev

Date and Time Formatting error

From Dev

Write date and time into LOG file in PHP

From Dev

Filter a log file by month, date and time in bash

From Dev

Log error of script to a file along with the date and time

From Dev

Log date and time accurately with batch file

From Dev

rsyslog template date/time format with seconds

From Dev

Logstash vs Rsyslog for log file aggregation

From Dev

Setting permisison of log file in rsyslog configuration

From Dev

Setting permisison of log file in rsyslog configuration

From Dev

rsyslog filtering and forwarding

Related Related

  1. 1

    rsyslog conditional forwarding for remote logs

  2. 2

    Rsyslog not forwarding specific log file to remote server

  3. 3

    Rsyslog not forwarding specific log file to remote server

  4. 4

    rsyslog not forwarding messages to remote rsyslog server

  5. 5

    rsyslog suppose to writing remote logs to a file by remote host name or ip address?

  6. 6

    Excel conditional formatting before and after time when date and time are mixed

  7. 7

    rsyslog only making log files in /var/logs

  8. 8

    Rsyslog outputting to custom log file

  9. 9

    rsyslog not writing dynamic log file

  10. 10

    Get rsyslog forwarding messages after remote server restart

  11. 11

    Get rsyslog forwarding messages after remote server restart

  12. 12

    configure rsyslog server to log incomming messages with time of the rsyslog server

  13. 13

    Using exec and tee to redirect logs to stdout and a log file in the same time

  14. 14

    Conditional Formatting using Date Comparison

  15. 15

    Excel Conditional Formatting for Date colums

  16. 16

    excel conditional formatting validate date

  17. 17

    Formatting date time in SSRS

  18. 18

    Formatting date and time in PowerShell

  19. 19

    Date Time Format is not Formatting

  20. 20

    Date and Time Formatting error

  21. 21

    Write date and time into LOG file in PHP

  22. 22

    Filter a log file by month, date and time in bash

  23. 23

    Log error of script to a file along with the date and time

  24. 24

    Log date and time accurately with batch file

  25. 25

    rsyslog template date/time format with seconds

  26. 26

    Logstash vs Rsyslog for log file aggregation

  27. 27

    Setting permisison of log file in rsyslog configuration

  28. 28

    Setting permisison of log file in rsyslog configuration

  29. 29

    rsyslog filtering and forwarding

HotTag

Archive