Schedule log collection. | View post | Log collection solutions

fbrollo 7 years ago

Hi everyone,

Do you know if it is possible to schedule a module execution ?

Or does the Schedule function only takes Exec commands ?

Here is the solution I've come up with to schedule log sending:

<Input im_file_test>
        Module  im_file
        File    '/mnt/test/scheduler/*log'
        InputType       LineBased
        SavePos TRUE
        <Schedule>
                  When 0 12 * * *
                  Exec fileop->file_copy("/mnt/test/test.log", "/mnt/scheduler/test.log");
        </Schedule>
</Input>
<Output om_tcp_siem>
Module  om_tcp
Host    192.168.0.10
Port    514
OutputType      LineBased
</Output>
<Route RouteTestB>
    Path        im_file_test => om_tcp_siem
</Route>

Here is what I would like to do (getting rid of xm_fileop for access privilege reasons:)

<Input im_file_test>
        <Schedule>
          When 0 12 * * *
          Module  im_file
          File    '/mnt/test/test.log'
          InputType       LineBased
          SavePos TRUE
       </Schedule>
</Input>

Thank you for your time :)