Send tomcat logs with syslog-ng in Ubuntu Linux

Question

I am trying to setup syslog-ng to send tomcat logs (as well as all the other system logs) to a log server but it doesn't seem to be working, this is the line I have:

destination d_tomcat { file("/opt/tomcat/logs/*.log"); };

And then of course this:

log { source(s_src); destination(d_net); };

and this

destination d_net { tcp("x.x.x.x" port(1514) log_fifo_size(1000)); };

Answer 1

you need a source that reads the tomcat logs, and sends them over to your log server. So assuming that tomcat logs into a file, you need something like:

source s_file { file("/opt/tomcat/logs/tomcat.log" multi-line-mode(indented)); };

(Note that the "/opt/tomcat/logs/*.log" will not currently work in syslog-ng Open Source Edition, because it does not yet support wildcards in the source - you have to specify the file to read) Then the destination:

destination d_net { tcp("x.x.x.x" port(1514) log_fifo_size(1000)); };

See the syslog-ng documentation for more details.

And the log statement to connect them:

log { source(s_file); destination(d_net); };