1

AIX server's rsyslog (imfile module) is not forwarding custom application logs from a specific folder that has multiple log files generated each and every day. The log file's name pattern differs. I need help forwarding logs from those files and the files that will be generated in future. As of now in the configuration, i have given the wildcard (in $InputFileName) to read the files as .log. as per the file name's pattern.

The file names are as follows:

abcd0000.log.190610
sdef0001.log.190611
asdfghjklas0000.log.190612
qwerty0004.log.190613

The imfile module configuration part is as follows:

$ModLoad imfile
$InputFileName /usr/bada/custom/application/*.log.*
$InputFileTag application1:
$InputFileSeverity info
$InputFileFacility local6
$InputFileMonitor

The version of rsyslog is:

rsyslogd 8.4.2, compiled with:
FEATURE_REGEXP:                          yes
GSSAPI kerberos 5 support:               No
FEATURE_DEBUG (debug build, slow code):  No
32bit Atomic operations supported:       Yes
64bit Atomic operations supported:       No
memory allocator:                        system default
Runtime Instrumentation (slow code):     No
uuid support:                            No
Number of Bits in RainerScript integers: 64

This rsyslog is running on the Operating system,

AIX 7.2
7200-02-02-1806

1 Answer 1

1

I know this is old but I believe the issue is that you are using the legacy $ModLoad syntax which I think doesn't like wildcards in the file name.

Try switching to "module(load="imfile")" and using the updated syntax like

input(type="imfile"
      File="/usr/bada/custom/applicaiton/*.log.*"
      Tag="application1:"
      Severity="info"
      Facility="local6")

Also found this info on wildcards from https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#wildcards

Before Version: 8.25.0

Wildcards are only supported in the filename part, not in directory names.

/var/log/*.log works.

/var/log/*/syslog.log does not work.

Since Version: 8.25.0

Wildcards are supported in filename and paths which means these samples will work:

/var/log/*.log works. *

/var/log/*/syslog.log works. *

/var/log//.log works. *

All matching files in all matching subfolders will work. Note that this may decrease performance in imfile depending on how many directories and files are being watched dynamically.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .