5

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName?

Example:

InputFileName: /path/to/logs/*_error.log

Using the above example results in:

9351.070404487:7fd07e9be700: strm 0x7fd070004260: open error 2, file '/path/to/logs/*_error.log': No such file or directory

Is there a way to specify a pattern of files for rsyslog to include so that all log files that match a pattern will be included?

Dan
  • 657
  • 2
  • 9
  • 13

4 Answers4

7

As an update to this post rsyslog 8.5 (currently development but soon to be stable) does support wildcards, I've tested this and can confirm it is working.

Ian
  • 71
  • 1
  • 2
1

Ive done some research on this in the past. As of the last time i checked the imfile module doesn't support wildcards at all. Thought about possibly writing another input module but ended up just using syslog-ng on the hosts I need this functionality on.

Tim Brigham
  • 15,545
  • 10
  • 75
  • 115
  • It seems the free version of syslog-ng does not support wildcards... There is this work around: http://asylum.madhouse-project.org/blog/2013/09/10/howto-monitor-a-directory-of-logfiles/ – AXE Labs Aug 25 '14 at 19:35
0

Here are some details on what is required:

http://www.slideshare.net/rainergerhards1/using-wildcards-with-rsyslogs-file-monitor-imfile

The version will become 8.6.0 stable on December, 2nd 2014.

squillman
  • 37,883
  • 12
  • 92
  • 146
Rainer Gerhards
  • 1
  • 1
    Welcome to Server Fault! We generally discourage link-only answers since links break over time. It would be beneficial to add relevant snippets to your answer so this doesn't become obsolete if/when the link breaks. – squillman Nov 19 '14 at 18:05
0

In newer versions of rsyslog this has been addressed, see here, in the "Wildcards" section. It mentions that, as of version 8.25, wildcards have already been supported on file names only, and since 8.25 and on it also supports wildcards in paths (haven't tested it though).

However, (see also this) the wildcards are not supported in polling mode.

fyts
  • 101
  • 3