25.7. Using Rsyslog Modules Due to its modular design, rsyslog offers a variety of modules which provide additional functionality. Note that modules can be written by third parties. Most modules provide additional inputs (see Input Modules below) or outputs (see Output Modules below). Other modules provide special functionality specific to each module. The modules may provide additional configuration directives that become available after a module is loaded. To load a module, use the following syntax: where USDModLoad is the global directive that loads the specified module and MODULE represents your desired module. For example, if you want to load the Text File Input Module ( imfile ) that enables rsyslog to convert any standard text files into syslog messages, specify the following line in the /etc/rsyslog.conf configuration file: rsyslog offers a number of modules which are split into the following main categories: Input Modules - Input modules gather messages from various sources. The name of an input module always starts with the im prefix, such as imfile . Output Modules - Output modules provide a facility to issue message to various targets such as sending across a network, storing in a database, or encrypting. The name of an output module always starts with the om prefix, such as omsnmp , omrelp , and so on. Parser Modules - These modules are useful in creating custom parsing rules or to parse malformed messages. With moderate knowledge of the C programming language, you can create your own message parser. The name of a parser module always starts with the pm prefix, such as pmrfc5424 , pmrfc3164 , and so on. Message Modification Modules - Message modification modules change content of syslog messages. Names of these modules start with the mm prefix. Message Modification Modules such as mmanon , mmnormalize , or mmjsonparse are used for anonymization or normalization of messages. String Generator Modules - String generator modules generate strings based on the message content and strongly cooperate with the template feature provided by rsyslog . For more information on templates, see Section 25.3.3, "Templates" . The name of a string generator module always starts with the sm prefix, such as smfile or smtradfile . Library Modules - Library modules provide functionality for other loadable modules. These modules are loaded automatically by rsyslog when needed and cannot be configured by the user. A comprehensive list of all available modules and their detailed description can be found at http://www.rsyslog.com/doc/rsyslog_conf_modules.html . Warning Note that when rsyslog loads any modules, it provides them with access to some of its functions and data. This poses a possible security threat. To minimize security risks, use trustworthy modules only. 25.7.1. Importing Text Files The Text File Input Module, abbreviated as imfile , enables rsyslog to convert any text file into a stream of syslog messages. You can use imfile to import log messages from applications that create their own text file logs. To load imfile , add the following into /etc/rsyslog.conf : It is sufficient to load imfile once, even when importing multiple files. The USDInputFilePollInterval global directive specifies how often rsyslog checks for changes in connected text files. The default interval is 10 seconds, to change it, replace int with a time interval specified in seconds. To identify the text files to import, use the following syntax in /etc/rsyslog.conf : Four settings are required to specify an input text file: replace path_to_file with a path to the text file. replace tag: with a tag name for this message. replace state_file_name with a unique name for the state file . State files , which are stored in the rsyslog working directory, keep cursors for the monitored files, marking what partition has already been processed. If you delete them, whole files will be read in again. Make sure that you specify a name that does not already exist. add the USDInputRunFileMonitor directive that enables the file monitoring. Without this setting, the text file will be ignored. Apart from the required directives, there are several other settings that can be applied on the text input. Set the severity of imported messages by replacing severity with an appropriate keyword. Replace facility with a keyword to define the subsystem that produced the message. The keywords for severity and facility are the same as those used in facility/priority-based filters, see Section 25.3.1, "Filters" . Example 25.15. Importing Text Files The Apache HTTP server creates log files in text format. To apply the processing capabilities of rsyslog to apache error messages, first use the imfile module to import the messages. Add the following into /etc/rsyslog.conf :

Commands:
USDModLoad MODULE
USDModLoad imfile
USDModLoad imfile USDInputFilePollInterval int
File 1 USDInputFileName path_to_file USDInputFileTag tag: USDInputFileStateFile state_file_name USDInputFileSeverity severity USDInputFileFacility facility USDInputRunFileMonitor File 2 USDInputFileName path_to_file2
USDModLoad imfile USDInputFileName /var/log/httpd/error_log USDInputFileTag apache-error: USDInputFileStateFile state-apache-error USDInputRunFileMonitor