title: Hos to use rsyslog to ship non-syslog files to remote server?
body: <p>I've been following this <a href="https://techpunch.co.uk/development/how-to-ship-logs-with-rsyslog-and-logstash" rel="nofollow">rsyslog/logstash article</a> to try to ship my applications' log files to a remote server, via rsyslog. From that page, here are the steps I've taken. Note that firewall and SELinux are off on both client (VM sending logs) and server (VM receiving logs). I have proven via netcat utility that I can send packets between client and server.</p>
  
  <p>On my client side, I've configured my /etc/rsyslog.conf file like so:</p>
  
  <pre><code># Load the imfile module
  module(load="imfile" PollingInterval="10")
  
  # Include all config files in /etc/rsyslog.d/
  $IncludeConfig /etc/rsyslog.d/*.conf
  
  # Debugging
  $DebugFile /var/log/rsyslog-debug.log
  $DebugLevel 2
  
  # General configuration
  $RepeatedMsgReduction off
  
  $WorkDirectory /var/spool/rsyslog
  
  $ActionQueueFileName mainqueue
  $ActionQueueMaxDiskSpace 500M
  $ActionQueueSaveOnShutdown on
  $ActionQueueType LinkedList
  $ActionResumeRetryCount -1
  
  # Template for non json logs, just sends the message wholesale with extra
  # # furniture. 
  template(name="textLogTemplate"
    type="list") {
    constant(value="{ ")
    constant(value="\"type\":\"")
    property(name="programname")
    constant(value="\", ")
    constant(value="\"host\":\"")
    property(name="%HOSTNAME%")
    constant(value="\", ")
    constant(value="\"timestamp\":\"")
    property(name="timestamp" dateFormat="rfc3339")
    constant(value="\", ")
    constant(value="\"@version\":\"1\", ")
    constant(value="\"role\":\"app-server\", ")
    constant(value="\"sourcefile\":\"")
    property(name="$!metadata!filename")
    constant(value="\", ")
    constant(value="\"message\":\"")
    property(name="rawmsg" format="json")
    constant(value="\"}\n")
  }
  </code></pre>
  
  <p>On client side, I have /etc/rsyslog.d/01-trm-error-logs.conf</p>
  
  <pre><code>input(type="imfile"
      File="/usr/share/tomcat/dist/logs/trm-error.log"
      Tag="trm-error-logs:"
      readMode="2"
      escapeLF="on"
  )
  
  if $programname == 'trm-error-logs:' then {
      action(
          type="omfwd"
          Target="my.remoteserver.com"
          Port="514"
          Protocol="tcp"
          template="textLogTemplate"
      )
      stop
  }
  </code></pre>
  
  <p>On server side, I have in my /etc/rsyslog.conf</p>
  
  <pre><code># Provides TCP syslog reception
  $ModLoad imtcp
  $InputTCPServerRun 514
  </code></pre>
  
  <p>I've restarted the rsyslog service on both sides.</p>
  
  <p>However, I don't see logs being shipped out. I do see the contents of /usr/share/tomcat/dist/logs/trm-error.log in /var/log/messages, though I do NOT want them to appear there. I do see the contents of /usr/share/tomcat/dist/logs/trm-error.log being read per the contents of the /var/log/rsyslog-debug.log file I generate.</p>
  
  <p>I do run the following on the client machine, and see nothing.</p>
  
  <pre><code>tcpdump -i eth0 -n host my.remoteserver.com -P out -vvv
  </code></pre>