Piping log files to a syslog server

If you have a centralized syslog server, or you use Splunk for log tracking, you may find the need to get older log files into a syslog port on that server.

Edit: Using logger (as suggested by David and Jerry below) will give you a more reliable way to send the data to a syslog server:

cat some.log | logger -t UsefulLabel -h yoursyslogserver.com -p 514

You'll also be able to set a label for the text before it's piped into the syslog server, which would be handy if you're sorting or parsing the data later on.

Also, you can send your data in the raw using netcat:

cat some.log | nc -w 1 -u yoursyslogserver.com 514
Printed from: http://rackerhacker.com/2009/04/21/piping-log-files-to-a-syslog-server/ .
© Major Hayden 2012.

2 Comments   »

  • Do it better with logger:

    cat some.log | logger -t UsefulLabel

    ...will enter the contents of some.log, with UsefulLabel prepended to it.

    ...your syslog IS set up to log to a central location, right?...

  • Syslog.org says:

    David is correct. You will have much better luck using logger. I would add, though, that you can bypass the local syslog using logger:

    cat some.log | logger -t UsefulLabel -h yoursyslogserver.com -p 514

    Otherwise, you will have to have have your local syslogd set up to forward the messages on to yoursyslogserver.com, which may or may not be acceptable.

Trackbacks/Pingbacks

  1. Logging « Eikonal Blog

RSS feed for comments on this post

Leave a Reply

 

  • Welcome! I started this blog as a way to give back to all of the other system administrators who have taught me something in the past. Writing these posts brings me a lot of enjoyment and I hope you find the information useful. If you spot something that's incorrect or confusing, please write a comment and let me know. Drop me a line if there's something you want to know more about and I'll do my best to write a post on the topic.
    -- Major Hayden

    Flattr this