Hi David,
The master conf file is simple with few additions that are
self-explanatory. The other conf in rsyslog.d, I have added comments inline
in the conf that explain the config logic.
/etc/rsyslog.conf
=======================================================================
module(load="impstats" interval="600" severity="7"
log.syslog="off" /* need to turn log stream logging off! */
log.file="/var/log/rsyslog-stats.log")
$ModLoad imuxsock.so # Unix sockets
$ModLoad imklog.so # Kernel logger
$MainMsgQueueSize 1000000
$OMFileIOBufferSize 512k
$MaxMessageSize 8k
$MainMsgQueueWorkerThreads 64
$umask 0000
$FileOwner joe
$FileGroup joe
$DirOwner joe
$DirGroup joe
$DirCreateMode 0755
$FileCreateMode 0644
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$RuleSet local
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$DefaultRuleset local
=======================================================================
/etc/rsyslog.d/cef.conf
=======================================================================
# Senders are four Arcsight Logger devices that send logs in CEF format
#template for writing CEF formatted logs
template(name="cefdynfile" type="string"
string="/var/log/joe/%$!vendor%/%$!product%/logfile")
#template for writing logs from non-CEF sources
template(name="noncefdynfile" type="string"
string="/var/log/joe/noncef/%hostname%/%programname%/logfile")
ruleset(name="tcpcef") {
#CEF uses the pipe delimiter, fields 2 and 3 are product vendor and product
type respectively
set $!vendor = field($msg, 124, 2);
set $!product = field($msg, 124, 3);
# Rules to write CEF formatted logs to disk and send logs by app type to
their flume destinations that are listening on the same box
if $syslogtag=="CEF:" then { action (type="omfile" ASyncWriting="on"
IOBufferSize="8192K" FileOwner="joe" FileGroup="joe" DirOwner="joe"
DirGroup="joe" DirCreateMode="0755" FileCreateMode="0644"
DynaFile="cefdynfile") }
if $!product == "app1" then { action (type="omfwd" Target="127.0.0.1"
Port="5161" Protocol="tcp") stop }
if $!product == "app2" then { action (type="omfwd" Target="127.0.0.1"
Port="5146" Protocol="tcp") stop }
if $!product == "app3" then { action (type="omfwd" Target="127.0.0.1"
Port="5172" Protocol="tcp") stop }
if $!product == "app4" then { action (type="omfwd" Target="127.0.0.1"
Port="5162" Protocol="tcp") stop }
if $!product == "app5" then { action (type="omfwd" Target="127.0.0.1"
Port="5166" Protocol="tcp") stop }
if $!product == "app6" then { action (type="omfwd" Target="127.0.0.1"
Port="5163" Protocol="tcp") stop }
if $!product == "app7" then { action (type="omfwd" Target="127.0.0.1"
Port="5164" Protocol="tcp") stop }
if $!product == "app8" then { action (type="omfwd" Target="127.0.0.1"
Port="5177" Protocol="tcp") stop }
if $!product == "app9" then { action (type="omfwd" Target="127.0.0.1"
Port="5144" Protocol="tcp") stop }
if $!product == "app10" then { action (type="omfwd" Target="127.0.0.1"
Port="5145" Protocol="tcp") stop }
if $!product == "app11" then { action (type="omfwd" Target="127.0.0.1"
Port="5148" Protocol="tcp") stop }
if $!product == "app12" then { action (type="omfwd" Target="127.0.0.1"
Port="5180" Protocol="tcp") stop }
if $!product == "app13" then { action (type="omfwd" Target="127.0.0.1"
Port="5147" Protocol="tcp") stop }
if $!product == "app14" then { action (type="omfwd" Target="127.0.0.1"
Port="5149" Protocol="tcp") stop }
if $!product == "app15" then { action (type="omfwd" Target="127.0.0.1"
Port="5150" Protocol="tcp") stop }
if $!product == "app16" then { action (type="omfwd" Target="127.0.0.1"
Port="5151" Protocol="tcp") stop }
if $!product == "app17" then { action (type="omfwd" Target="127.0.0.1"
Port="5152" Protocol="tcp") stop }
if $!product == "app18" then { action (type="omfwd" Target="127.0.0.1"
Port="5153" Protocol="tcp") stop }
if $!product == "app19" then { action (type="omfwd" Target="127.0.0.1"
Port="5155" Protocol="tcp") stop }
if $!product == "app20" then { action (type="omfwd" Target="127.0.0.1"
Port="5156" Protocol="tcp") stop }
if $!product == "app21" then { action (type="omfwd" Target="127.0.0.1"
Port="5157" Protocol="tcp") stop }
if $!product == "app22" then { action (type="omfwd" Target="127.0.0.1"
Port="5158" Protocol="tcp") stop }
if $!product == "app23" then { action (type="omfwd" Target="127.0.0.1"
Port="5159" Protocol="tcp") stop }
if $!product == "app24" then { action (type="omfwd" Target="127.0.0.1"
Port="5160" Protocol="tcp") stop }
if $!product == "app25" then { action (type="omfwd" Target="127.0.0.1"
Port="5178" Protocol="tcp") stop }
if $!product == "app26" then { action (type="omfwd" Target="127.0.0.1"
Port="5165" Protocol="tcp") stop }
if $!product == "app27" then { action (type="omfwd" Target="127.0.0.1"
Port="5165" Protocol="tcp") stop }
if $!product == "app28" then { action (type="omfwd" Target="127.0.0.1"
Port="5167" Protocol="tcp") stop }
if $!product == "app29" then { action (type="omfwd" Target="127.0.0.1"
Port="5167" Protocol="tcp") stop }
if $!product == "app30" then { action (type="omfwd" Target="127.0.0.1"
Port="5179" Protocol="tcp") stop }
if $!product == "app31" then { action (type="omfwd" Target="127.0.0.1"
Port="5169" Protocol="tcp") stop }
if $!product == "app32" then { action (type="omfwd" Target="127.0.0.1"
Port="5170" Protocol="tcp") stop }
if $!product == "app33" then { action (type="omfwd" Target="127.0.0.1"
Port="5171" Protocol="tcp") stop }
if $!product == "app34" then { action (type="omfwd" Target="127.0.0.1"
Port="5174" Protocol="tcp") stop }
if $!product == "app35" then { action (type="omfwd" Target="127.0.0.1"
Port="5173" Protocol="tcp") stop }
if $!product == "app36" then { action (type="omfwd" Target="127.0.0.1"
Port="5175" Protocol="tcp") stop }
if $!product == "app37" then { action (type="omfwd" Target="127.0.0.1"
Port="5176" Protocol="tcp") stop }
if $!product == "app38" then { action (type="omfwd" Target="127.0.0.1"
Port="5154" Protocol="tcp") stop }
if $!product == "app39" then { action (type="omfwd" Target="127.0.0.1"
Port="5181" Protocol="tcp") stop }
# Unfortunately, the four Arcsight Loggers also send us garbage so whatever
could not be parsed/classified correctly by the rules above, gets parked in
a catchall file.
if $fromhost-ip == '10.1.1.100' or $fromhost-ip == '10.1.1.101' or
$fromhost-ip == '10.1.1.102' or $fromhost-ip == '10.1.1.103' then { action
(type="omfile" FileOwner="joe" FileGroup="joe" DirOwner="joe"
DirGroup="joe" DirCreateMode="0755" FileCreateMode="0644"
file="/var/log/joe/fallback/logfile")
& action (type="omfwd" Target="127.0.0.1" Port="5182" Protocol="tcp"
)
stop }
# Take care of all the non-CEF / BSD Syslog formatted streams coming in
else {
action (type="omfile" ASyncWriting="on" IOBufferSize="8192K"
FileOwner="joe" FileGroup="joe" DirOwner="joe" DirGroup="joe"
DirCreateMode="0755" FileCreateMode="0644" DynaFile="noncefdynfile")
& action (type="omfwd" Target="127.0.0.1" Port="5182" Protocol="tcp")
}
}
module(load="imtcp" ) # needs to be done just once
input(type="imtcp" port="514" ruleset="tcpcef")
=======================================================================
Here's the logrotate code:
=======================================================================
/var/log/joe/*/*/*
/var/log/joe/*/*/*/*
{
missingok
size 1G
rotate 0
sharedscripts
postrotate
if [ -f /var/run/syslog.pid ]; then \
kill -HUP `cat /var/run/syslog.pid`; \
fi;
endscript
}
=======================================================================
On Tue, Jun 25, 2013 at 10:12 AM, David Lang <[email protected]> wrote:
> On Tue, 25 Jun 2013, Xuri Nagarin wrote:
>
> On RHEL 6.2 64-bit, I have Rsyslog 7.4.1 (actually, the issue has existed
>> for earlier versions too).
>>
>> After logrotation, the logrotate script HUPs the rsyslogd pid but the disk
>> space doesn't free up until I restart rsyslog. After a few hours "df"
>> reports a full filesystem whereas "ls" shows much smaller file sizes. In
>> between this confusion, rsyslog seems to stop receiving log streams.
>>
>> Is there a way for rsyslog to switch file handles when it is HUP-ed?
>>
>
> rsyslog is already supposed to close and re-open files when it's HUP-ed,
> and it seems to be working for me and many others.
>
> could you send your config file so we can see if there is anything unusual
> in it?
>
> David Lang
> ______________________________**_________________
> rsyslog mailing list
> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
