Ask A Question

Questions

1
ANSWERED

[Nxlog] How can I forward my logs on a local central server with Nxlog ?

If you want to centralize all your logs from several **originator servers** to a **collector server** before sending them to [logmatic.io](http://logmatic.io/), here is what you need to do: ##On the **Collector server** Add an input module into your collector server *nxlog.conf* file to listen to any tcp connections on a choosen port: ``` <Input input_collector> Module im_tcp Host 0.0.0.0 Port <your_choosen_port> </Input> ``` **The host field:** - This specifies the IP address or a DNS hostname which the module should listen on **to accept connections**. Because of security reasons the default listen address is localhost if this directive is not specified (the localhost loopback address is not accessible from the outside). You will most probably want to send logs from remote hosts, so make sure that the address specified here is accessible. **The any address 0.0.0.0 is commonly used here** Then edit your Route module of your collector server *nxlog.conf* file to forward all your log entries to logmatic.io: ``` ############ ROUTES TO CHOOSE ##### <Route 1> Path syslog,input_collector => out </Route> ``` ##On the **Originator server** Change the output module of your originator *nxlog.conf* file into: ``` <Output out> Module om_tcp Host <your_collector_server> Port <your_choosen_port> </Output> ``` **The host field:** This specifies the IP address or a DNS hostname to which the module should send the log entries

Posted by Pierre Guceski 3 years ago

1
ANSWERED

[Syslog-ng] How can I replace part of a log message with syslog-ng?

To replace a part of the log message with Syslog-ng, you have to: - Define a string or regular expression to find the text to replace. - Define a string to replace the original text (macros work as well). - Select the field of the message that the rewrite rule should process. You can rewrite the structured-data fields of messages complying to the [RFC5424](https://tools.ietf.org/html/rfc5424) message format. **Substitution rules use the following syntax:** ``` rewrite <name_of_the_rule> { subst("<string or regular expression to find>", "<replacement string>", value(<field name>), flags() ); }; ``` The `type()` and `flags()` options are optional: - `type()` specifies the type of regular expression to use - `flags()` are the [flags](http://doc.logmatic.io/discuss/568cd56313c5ad0d00b34ea3) of the regular expressions. **The following example replace every occurence of IP in the text of the message with the string IP-Address:** ``` rewrite r_rewrite_subst{ subst("IP", "IP-Address", value("MESSAGE"), flags("global")); }; ``` A single substitution rule can include multiple substitutions that are applied sequentially to the message. Note that rewriting rules must be included in the log statement to have any effect. **The following rules replace the first occurrence of the string IP with the string IP-Addresses:** ``` rewrite r_rewrite_subst{ subst("IP", "IP-Address", value("MESSAGE")); subst("Address", "Addresses", value("MESSAGE")); }; ```

Posted by Pierre Guceski 3 years ago