My app is producing logs under
/var/log/myapp/app.log
I need to send all the logs under app.log to my syslog file /var/log/syslog.
I created a file with following content /etc/rsyslog.d
$WorkDirectory /var/spool/rsyslog
$template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"
# Log shipment rsyslog target servers
$ActionQueueFileName appfile
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount 250
*.* @10.x.x.1;RFC3164fmt
# Log files
$InputFileName /var/log/myapp/app.log
$InputFileTag app:
$InputFileStateFile state-app
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
10.x.x.1 is the same node where rsyslog is installed and my app is running.
once i restart rsyslog am getting following error in syslog file
invalid or yet-unknown config file command 'InputFileName' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
invalid or yet-unknown config file command 'InputFileTag' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
invalid or yet-unknown config file command 'InputFileStateFile' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
invalid or yet-unknown config file command 'InputFileFacility' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
invalid or yet-unknown config file command 'InputFilePollInterval' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
invalid or yet-unknown config file command 'InputFilePersistStateInterval' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
invalid or yet-unknown config file command 'InputRunFileMonitor' - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]
I also checked couple of SO links and changed my /etc/rsyslog.conf file entry to change the user . but I
#$PrivDropToUser syslog
$PrivDropToUser appuser
#$PrivDropToGroup syslog
$PrivDropToGroup appuser
