topic Re: Syslogging via tailing a logfile in Getting Data In

Syslogging via tailing a logfile

NK_1 — Fri, 21 Sep 2012 20:55:59 GMT

Ideally, we'd like to modify the application to syslog directly for indexing by Splunk.
In the meantime, is there any adverse effect to tailing the last line of the log, and invoking logger to syslog?



#!/bin/bash

tail -n1 -F -q MyLogFile.log | \

while read -r line ; do

   # send to local syslog

   logger -t MyAppTag -p local1.info `echo "$line"`

done

Re: Syslogging via tailing a logfile

numentajpb — Sat, 12 Jan 2013 00:56:17 GMT

I'm curious, why not have splunkforwarder just monitor the logfile directly?

Re: Syslogging via tailing a logfile

NK_1 — Sat, 12 Jan 2013 01:19:16 GMT

That would involve installing the forwarder on every host we use. Our hosts are already set up to forward local syslogged events to be indexed by Splunk, and I am trying to leverage that mechanism.

Re: Syslogging via tailing a logfile

Linegod — Sun, 13 Jan 2013 18:56:42 GMT

We replace syslog with rsyslog, which can send arbitrary files to syslog.

rsyslog imfile