<div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Sun, Aug 26, 2018 at 8:41 PM Vitaliy Tolyupa <<a href="mailto:vetalvv@mail.ru">vetalvv@mail.ru</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:inherit;font-family:Arial,'Helvetica Neue',Helvetica,sans-serif;font-size:15px;vertical-align:baseline;box-sizing:inherit;clear:both;color:#242729;letter-spacing:normal;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:#ffffff;text-decoration-style:initial;text-decoration-color:initial">Hi Guys!<br><br>I have following congiguration: 1. server with journald and journald-upload (client server) 2. Central log server with journald and journald-remote and rsyslog.</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:inherit;font-family:Arial,'Helvetica Neue',Helvetica,sans-serif;font-size:15px;vertical-align:baseline;box-sizing:inherit;clear:both;color:#242729;letter-spacing:normal;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:#ffffff;text-decoration-style:initial;text-decoration-color:initial">I configured sending logs from journald-upload to journald-remote (This is my central log server).</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:inherit;font-family:Arial,'Helvetica Neue',Helvetica,sans-serif;font-size:15px;vertical-align:baseline;box-sizing:inherit;clear:both;color:#242729;letter-spacing:normal;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:#ffffff;text-decoration-style:initial;text-decoration-color:initial">Next, I need to forward logs from central log server to Logstash. Because of logstash-input-journald has some issues, I wanna use rsyslog as a transport between journald-remote server and logstash.</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:inherit;font-family:Arial,'Helvetica Neue',Helvetica,sans-serif;font-size:15px;vertical-align:baseline;box-sizing:inherit;clear:both;color:#242729;letter-spacing:normal;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:#ffffff;text-decoration-style:initial;text-decoration-color:initial">Sending logs from journald to rsyslog on the local server works fine. But I don't understand why logs from journald-upload to central server doesn't send to rsyslog on the remote server. On the central server, localy sending logs from jornald ro rsyslog work fine.</p></div></blockquote><div>Because journald-remote doesn't generate log events in the usual way; it directly builds a *.journal file on disk.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:inherit;font-family:Arial,'Helvetica Neue',Helvetica,sans-serif;font-size:15px;vertical-align:baseline;box-sizing:inherit;clear:both;color:#242729;letter-spacing:normal;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:#ffffff;text-decoration-style:initial;text-decoration-color:initial">How to send logs, accepted from journald-upload to rsyslog on the central server?</p></div></blockquote><div>Take a look at rsyslogd's "imjournal" module, which can read systemd's *.journal files.</div><div><br></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Mantas Mikulėnas</div></div></div>