Issue with multiple logs files forwarding with rsyslog? - linux

Question

I have a use case, where I need to forward multiple log files to remote server.
//Log Files
1. /var/log/boot.log
2. /path/to/tomcat/tomcat.log
3. /path/to/app/app.log
I have added 3 conf files in /etc/rsyslog.d/
#/etc/rsyslog.d/boot.conf
$ModLoad imfile
$InputFilePollInterval 10
$InputFileName /var/log/boot.log
$InputFileTag boot-log
$InputRunFileMonitor
$InputFilePersistStateInterval 100
#/etc/rsyslog.d/tomcat.conf
$ModLoad imfile
$InputFilePollInterval 10
$InputFileName /path/to/tomcat.log
$InputFileTag tomcat-log
$InputRunFileMonitor
$InputFilePersistStateInterval 100
#/etc/rsyslog.d/app.conf
$ModLoad imfile
$InputFilePollInterval 10
$InputFileName /path/to/app.log
$InputFileTag app-log
$InputRunFileMonitor
$InputFilePersistStateInterval 100
To include these file I've added this line $IncludeConfig /etc/rsyslog.d/*.conf.
but in /var/log/syslog just boot logs are adding up rest of the configs are getting ignored.
RsysLog Version: 8.1907.0 (aka 2019.07)

Answer 1

Maybe the answer should be in the rsyslog's documentation:
$ModLoad imfile # needs to be done just once
# File 1
$InputFileName /path/to/file1
$InputFileTag tag1:
$InputFileStateFile stat-file1
$InputFileSeverity error
$InputFileFacility local7
$InputRunFileMonitor
# File 2
$InputFileName /path/to/file2
$InputFileTag tag2:
$InputFileStateFile stat-file2
$InputRunFileMonitor
# ... and so on ...
# check for new lines every 10 seconds $InputFilePollingInterval 10
In that way, you have re-defined the module load itself, that should be defined before the file includes.