Imfile in rsyslog running on AIX Server 7.2
AIX server's rsyslog (imfile module) is not forwarding custom application logs from a specific folder that has multiple log files generated each and every day. The log file's name pattern differs. I need help forwarding logs from those files and the files that will be generated in future. As of now in the configuration, i have given the wildcard (in $InputFileName
) to read the files as .log.
as per the file name's pattern.
The file names are as follows:
abcd0000.log.190610
sdef0001.log.190611
asdfghjklas0000.log.190612
qwerty0004.log.190613
The imfile module configuration part is as follows:
$ModLoad imfile
$InputFileName /usr/bada/custom/application/*.log.*
$InputFileTag application1:
$InputFileSeverity info
$InputFileFacility local6
$InputFileMonitor
The version of rsyslog is:
rsyslogd 8.4.2, compiled with:
FEATURE_REGEXP: yes
GSSAPI kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: No
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: No
Number of Bits in RainerScript integers: 64
This rsyslog is running on the Operating system,
AIX 7.2
7200-02-02-1806
I know this is old but I believe the issue is that you are using the legacy $ModLoad syntax which I think doesn't like wildcards in the file name.
Try switching to "module(load="imfile")" and using the updated syntax like
input(type="imfile"
File="/usr/bada/custom/applicaiton/*.log.*"
Tag="application1:"
Severity="info"
Facility="local6")
Also found this info on wildcards from https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#wildcards
Before Version: 8.25.0
Wildcards are only supported in the filename part, not in directory names.
/var/log/*.log works.
/var/log/*/syslog.log does not work.
Since Version: 8.25.0
Wildcards are supported in filename and paths which means these samples will work:
/var/log/*.log works. *
/var/log/*/syslog.log works. *
/var/log//.log works. *
All matching files in all matching subfolders will work. Note that this may decrease performance in imfile depending on how many directories and files are being watched dynamically.