Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently setup one of our servers as an rsyslog server. I now have our firewall setup to log everything to that rsyslog server.

But there doesn't seem to be an organization of the logs. All the firewall logs are just being dumped into the /var/log/messages on the rsyslog server. I guess I was maybe expecting them to at least be in a machine specific log file or directory.

How can I organize the incoming logging? If I setup 20 servers to all log everything to a central rsyslog server, I really don't want everything being dumped into one big file or a few files. How can I setup rsyslog to tell it where to log what? Like if all the logs for a specific server were in it's own directory/file, etc... Is this possible?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Rsyslog has a pretty good configuration system which allows you to create logs in many different ways. Check the online docs.

Specifically you may want to check out the configuration samples. This recipe may be close to what you want.

http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory

share|improve this answer
    
Excellent. The appears to be what I'm looking for. Thanks! –  Jakobud Jan 5 '11 at 22:03
    
I've copy/pasted that exact configuration into my /etc/rsyslog.conf and restarted rsyslogd w/o error, but I'm still not getting any logs for other servers showing up anywhere but in messages. Any thoughts? –  Jakobud Feb 10 '11 at 21:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.