Getting arbitrary log files into Rsyslog

Ideally, the applications that you're working with already supports the syslog standard. Failing that, it's often necessary to suck a regular text log file into rsyslog. Doing so is fairly easy, but I had a harder time than I suspected finding the documentation.

The key is the optional rsyslog module imfile. It's not enabled by default, so you will need to enable it.

vim /etc/rsyslog.conf

# add the following
$ModLoad imfile

You will also need to configure each log file you want to poll. If you want, you can place these settings in separate files under /etc/rsyslog.d. In this case, my application is called "celery".

vim /etc/rsyslog.d/celery.conf

# add the following
$InputFileName /var/log/django/celery.log
$InputFileTag celery
$InputFileStateFile celery-file1
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
$InputFilePersistStateInterval 1000

# exit vim, and restart rsyslog
service rsyslog restart

This will poll celery.log every 10 seconds, and echo the contents into syslog. You can then forward them to remote machines as necessary.

Chase Seibert