Using that .conf file, the file logging is sending something , but does not seem to be sending to NLS. Also the log to the file is not right. Here is what is being put into the file /var/opt/lrms/log/jupiter.log
The only problem with those removed, would that now no longer log to the file /var/opt/lrms/log/jupiter.log.
Those were in a separate file. I was trying to set things up using one file which would send to /var/opt/lrms/log/jupiter.log, as the app sets up on install, and have them sent to the NLS.
That's what I thought, but I figured you guys were the professionals, and since I have not spent the night at a holiday Inn Express lately, you guys would know better......
I'll try removing that line and see what happens...
[root@igaqarep rsyslog.d]# cat 89-jupiter.conf
$template JupiterFormat,"%TIMESTAMP:::date-rfc3339% %msg:::sp-if-no-1st-sp% %msg:::drop-last-lf%\n"
if ($msg contains "jupiter") then /var/opt/lrms/log/jupiter.log;JupiterFormat
if ($msg contains "jupiter") then ~
#$ModLoad imfile
#$InputFilePollInterval 10
#$PrivDropToGroup adm
#$WorkDirectory /var/lib/rsyslog
## Input for import_json
#$InputFileName /var/opt/lrms/log/jupiter.log
#$InputFileTag jupiter:
#$InputFileStateFile nls-state-var_opt_lrms_log_jupiter_log # Must be unique for each file being polled
## Uncomment the folowing line to override the default severity for messages
## from this file.
##$InputFileSeverity info
#$InputFilePersistStateInterval 20000
#$InputRunFileMonitor
## Forward to Nagios Log Server and then discard, otherwise these messages
## will end up in the syslog file (/var/log/messages) unless there are other
## overriding rules.
#if $programname == "jupiter" then @@iganagioslog:5583
#if $programname == "jupiter" then ~
So it must be something going on with how rsyslog is processing having the app log to the file, then trying to pick up the file and send to NLS.
Running a little test, I noticed that if I clear out the log, restart rsyslog, all works well.
Attached the /var/opt/lrms/log/jupiter.log. I have put notes in it where I started the log from blank, the where I restarted rsyslog. Seems at the restart of rsyslog, something is putting duplicate entries. The entries seem to be repeat of what is already in the file and adding time stamps each time....
You do not have the required permissions to view the files attached to this post.
GhostRider2110 wrote:Running a little test, I noticed that if I clear out the log, restart rsyslog, all works well.
Attached the /var/opt/lrms/log/jupiter.log. I have put notes in it where I started the log from blank, the where I restarted rsyslog. Seems at the restart of rsyslog, something is putting duplicate entries. The entries seem to be repeat of what is already in the file and adding time stamps each time....
This was why I said you didn't need those 2 lines at the top, because it is going to re-add what it is reading to the same file.
And yes, you would need to restart syslog for the changes to take affect.
