rsyslog for ITA 932

[RomeoEtisJr]

Hi Team,

One of our VIP customer requires their ITA server to send server logs to a remote server.

Does ITA support this? may we know the procedure? Today they did tried to configure rsyslogs but the file sent is 0.

In the console do we need to enable #forwardtosyslog which is currently showing NO?

rsyslog file sent by ITA is 0

 

Thanks,

Romeo

[gsterling · Accepted solution]

Hello Romeo

It should be possible to configure the ITA server to forward messages to a rsyslog server or a system like splunk.

A change has been made to recent ITA releases which makes this process easier, but for ITA 9.3.2 check these steps to setup the forwarding.

Schneider installs a file in /etc/rsyslog.d named “operation-logs.conf”.

• You will need to edit the operation-logs.conf file, and comment the three lines containing the word “stop” by placing a “#” character on those lines before the word “stop”.
• Save the changes to the file.

The above change is no longer required in newer ITA releases (9.3.5 and newer I think).

After making the above changes, you can use this process to forward log messages remotely.

Edit /etc/rsyslog.conf.

Add the forwarding directive in this format. You should be able to place this line at the bottom of the rsyslog.conf file. The below statement forwards all log messages.

*.* @@<remote-server>:<remote-port>

Then restart the rsyslog service

systemctl restart rsyslog

Regards

Greg Sterling

[RomeoEtisJr]

Thanks Greg!

This works for me. 

Romeo