Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a syslog server and we have all our servers logging to it.

We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.

Anyone know how to accomplish this?

share|improve this question
up vote 4 down vote accepted

So this is how I configured this in rsyslog.conf:

# Log remote hosts to separate log file
$template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
& ~

This traps all log messages received via UDP (imudp) and puts it in a file whose filename corresponds to the hostname the log message originated from.

share|improve this answer
Thanks, that's just what I was surfing for. – Doc Nov 15 '14 at 4:36
Thank you for the example using inputname. Half a dozen examples I found all tried matching on $hostname and the like... and none of them worked reliably for this :) – allaryin Mar 25 '15 at 17:00

I found very nice "how to" that will give you a good head start...

How to Setup Rsyslog Remote Logging on Linux (Central Log Server)

share|improve this answer
Edited question to clarify what I want. Let me know if that helps. – Belmin Fernandez Apr 26 '12 at 19:56
my answer will do exactly that – alexus Apr 26 '12 at 19:58
I believe the submitter is looking for a rule to use on the receiving syslog server to dump messages into files. – Steve Kemp Apr 26 '12 at 20:04
That's correct. My apologies @alexus for not being clear initially. – Belmin Fernandez Apr 26 '12 at 20:06
Pretty sparse on that link. – Fiasco Labs Oct 8 '13 at 16:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.