-1

I'm trying to send a custom log from a client to a syslog server.

The problem is that:

Rsyslog keep writing the same information in my log file.

How can I prevent rsyslog to write in my custom log file?

Version: rsyslogd 5.8.11

Client side:

$template ban-ip-template,"%rawmsg%\n"

local6.* @server-centreon


#################
#### MODULES ####
#################
$ModLoad imfile

$ModLoad imuxsock # provides support for local system logging

$ModLoad imklog   # provides kernel logging support

#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

# provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#

$FileOwner root

$FileGroup adm

$FileCreateMode 0640

$DirCreateMode 0755

$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/

$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log

*.*;auth,authpriv.none          -/var/log/syslog

#cron.*                         /var/log/cron.log

local6.none                     /var/log/messages

daemon.*                        -/var/log/daemon.log

kern.*                          -/var/log/kern.log

lpr.*                           -/var/log/lpr.log

mail.*                          -/var/log/mail.log

user.*                          -/var/log/user.log

local6.*                        /var/log/ip_banned.log;ban-ip-template

& ~
#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info

mail.warn                       -/var/log/mail.warn

mail.err                        /var/log/mail.err

#
# Logging for INN news system.
#
news.crit                       /var/log/news/news.crit

news.err                        /var/log/news/news.err

news.notice                     -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

#

#
# Emergencies are sent to everybody logged in.
#
*.emerg                         :omusrmsg:*

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#       news.=crit;news.=err;news.=notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

MyPersonal config:

/etc/rsyslog.d/ba-ip.conf

$InputFileName /var/log/ip_banned.log

$InputFileTag banned-ip

$InputFileStateFile ban-ip-ssh

$InputFileSeverity warn

$InputFileFacility local6

$InputFilePollInterval 5

$InputRunFileMonitor

my custom log: /var/log/ip_banned.log previously I only had in my log file those 2 lines:

172.16.200.110 banned using ssh

172.16.100.78 banned using ssh

Rsyslog keep adding:

172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh
172.16.100.78 banned using ssh
172.16.200.110 banned using ssh

Etc…………………..

How can I prevent rsyslog to write in my custom log?

I Have another problem, for example, when I delete in my log file everything thing that rsyslog added, It stop working, even when I restart rsyslog.

For it works back, I have to delete the config file and configure it back.

Is there a solution?

1 Answer 1

2

If you do not want rsyslogd to write to ip_banned.log the do not configure that as a destination for local6.*. Not sure if your ba-ip.conf is present on client or server, but it looks like you built a loop that reads and writes to the same file.

2
  • ba-ip.conf is present on client. I just want that rsyslog read ip_banned.log.
    – Kooky021
    Oct 22, 2014 at 7:29
  • As i said, looks like a loop. If the log file is your source, then do not let rsyslog write into the same file (as configured in rsyslog.conf, under 'Rules').
    – mschuett
    Oct 22, 2014 at 8:49

Not the answer you're looking for? Browse other questions tagged .