Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a syslog server and we have all our servers logging to it.

We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.

Anyone know how to accomplish this?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

So this is how I configured this in rsyslog.conf:

# Log remote hosts to separate log file
$template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
& ~

This traps all log messages received via UDP (imudp) and puts it in a file whose filename corresponds to the hostname the log message originated from.

share|improve this answer
    
Thanks, that's just what I was surfing for. –  Doc Nov 15 at 4:36

I found very nice "how to" that will give you a good head start...

How to Setup Rsyslog Remote Logging on Linux (Central Log Server)

share|improve this answer
    
Edited question to clarify what I want. Let me know if that helps. –  Belmin Fernandez Apr 26 '12 at 19:56
    
my answer will do exactly that –  alexus Apr 26 '12 at 19:58
    
I believe the submitter is looking for a rule to use on the receiving syslog server to dump messages into files. –  Steve Kemp Apr 26 '12 at 20:04
    
That's correct. My apologies @alexus for not being clear initially. –  Belmin Fernandez Apr 26 '12 at 20:06
    
Pretty sparse on that link. –  Fiasco Labs Oct 8 '13 at 16:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.