Linux: fine-grained disable-enable control of logs

#1 jfreyensee 2 years ago

Say I have the following nxlog.conf file:

<Input lc1> Module im_file File "/var/log/messages" </Input>

<Input lc2> Module im_file File "/var/log/mything.txt" </Input>

<Output fileout> Module om_file Exec if $Message =~ /error/ $SeverityValue = syslog_severity_value("error"); Exec to_syslog_bsd(); File "/var/log/logmsg2.txt" </Output>

<Route lcroute1> Path lc1 => fileout </Route>

<Route lcroute2> Path lc2 => fileout </Route>

Is there a way to just turn off the harvesting of Ic2 or the lcroute2 without having to modify or manually change the nxlog.conf file? Basically for this example nxlog.conf file have fine-grained adjustment/control of the logs if someone decides they want to turn off a log getting routed to the output file.

Thank you!

Permalink

#2 carlos.caro Nxlog ✓ 2 years ago

#1 jfreyensee

Say I have the following nxlog.conf file: <Input lc1> Module im_file File "/var/log/messages" </Input> <Input lc2> Module im_file File "/var/log/mything.txt" </Input> <Output fileout> Module om_file Exec if $Message =~ /error/ $SeverityValue = syslog_severity_value("error"); Exec to_syslog_bsd(); File "/var/log/logmsg2.txt" </Output> <Route lcroute1> Path lc1 => fileout </Route> <Route lcroute2> Path lc2 => fileout </Route> Is there a way to just turn off the harvesting of Ic2 or the lcroute2 without having to modify or manually change the nxlog.conf file? Basically for this example nxlog.conf file have fine-grained adjustment/control of the logs if someone decides they want to turn off a log getting routed to the output file. Thank you!

Hi Jay,

You certainly need to modify the configuration file to achieve this, but to simplify things, create two (2) seperate configuration files with the Route block only, and then, make use of the include directive as follow to enable or disable an specific route:

lcroute1.conf

<Route lcroute1>
        Path lc1 => fileout
</Route>

lcroute2.conf

<Route lcroute2>
        Path lc2 => fileout
</Route>

nxlog.conf (all routes included and enabled)

...
<Input lc1>
        Module im_file
        File "/var/log/messages"
</Input>

<Input lc2>
        Module im_file
        File "/var/log/mything.txt"
</Input>

<Output fileout>
        Module om_file
        Exec if $Message =~ /error/ $SeverityValue = syslog_severity_value("error");
        Exec to_syslog_bsd();
        File "/var/log/logmsg2.txt"
</Output>

include /etc/nxlog/lcroute1.conf
include /etc/nxlog/lcroute2.conf

To disable route lcroute2, just comment out the lcroute2.conf line like:

...
include /etc/nxlog/lcroute1.conf
#include /etc/nxlog/lcroute2.conf

And remember to restart the agent.

Regards,
Carlos.