'Rsyslog' is a open-source utility used for forwarding, managing and story log messages on Linux Systems.
It does support various log message formats and protocols, enabling us to collect and forward logs to remote servers or storage destinations.
Customers can configure custom rules under /etc/rsyslog.d to selectively forward specific logs from the Versa Director to an external syslog server, based on the use cases.
Example, a sample configuration file configured under /etc/rsyslog.d to forward auth logs from Director to external server :
admin@Director-DC1:/etc/rsyslog.d$ sudo vi 10-comgmt.conf
module(load="imfile" PollingInterval="10") #needs to be done just once
# File 1
input(type="imfile"
File="/var/log/auth.log"
Tag="comgmt"
Severity="info"
Facility="local7")
:syslogtag, contains, "comgmt"
action(type="omfwd" target="X.X.X.X" port="514" protocol="udp")
Please note that when configuring the input parameters customer might also add "StateFile"
in the input configuration for example (StateFile="statefile1" )
Currently Versa Director is running the latest version of rsyslog, which is rsyslog8.
Which can be verified using : "sudo service rsyslog status "
From rsyslog version 8, the parameter StateFile is depreciated and hence rsyslog can throw an error as follows :
rsyslogd[18184]: error during parsing file /etc/rsyslog.d/XXXX.conf, on or before line X: parameter 'statefile' deprecated.
The error can be seen either while checking the rsyslog status.
sudo service rsyslog status
It can also be located in /var/log/syslog
While we try to restart the rsyslog service. "sudo service rsyslog restart"
Hence its recommended to not use StateFile parameter while configuring custom rules under /etc/rsyslog.d
For further information, please refer official rsyslog documentation:
https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html