On 05/03/14 16:39, Florian Ernst wrote: > On Wed, Mar 05, 2014 at 04:13:08PM +0100, Daniel Pocock wrote: >> On 05/03/14 14:38, Florian Ernst wrote: >>> ITIYM http://www.rsyslog.com/using-mongodb-with-rsyslog-and-loganalyzer/ >>> in particular? >>> >>> Not until now. Previously I followed >>> http://www.rsyslog.com/doc/rsyslog_conf_modules.html/ommongodb.html >>> (which now redirects to http://www.rsyslog.com/doc/ommongodb.html). >>> >>> I have now tried to implement the configuration mentioned there >>> verbatim. This led to remote logs simply disappearing, i.e. not being >>> logged on my syslog host. Thus I have reverted the change, for my >>> current mongodb rsyslog configuration please see the other mail to >>> Daniel. > Following up to that: the config given in the first link looks like it > should actually do the trick. It reads as if the missing parsing should > take place. When you say "first link", did you mean this one:
http://www.rsyslog.com/using-mongodb-with-rsyslog-and-loganalyzer/ I had a look at that It basically appears that a) local log entries and entries defined on existing transports are not sent to mongodb using anything in that example b) log entries received over TCP port 13514 will be sent to mongodb, but only if they are in the CEE format (not just any syslog entry) > But as that config broke my remote syslog, I didn't tinker with it any > further. It might be that there's a separate problem in my remote > logging configuration, but I don't really see myself exploring that > posiibility further at the moment, given that I lack a safe testing > environment. When you say broke your remote syslog, maybe your remote syslog is not sending to it with CEE format? I'm not sure that everybody will want to use the CEE format, many devices may only support regular syslog format, so a more basic example is needed too -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
