I use ubuntu-server. I try to set filter in my rsyslog.conf for accepting only remote logs from my D-link.
that is debug
Debug line with all properties: FROMHOST: 'fromname', fromhost-ip: '192.168.1.1', HOSTNAME: 'DSR-500N', PRI: 4, syslogtag 'KERNEL', programname: 'KERNEL', APP-NAME: 'KERNEL', PROCID: '-', MSGID: '-', TIMESTAMP: 'Oct 2 17:44:08', STRUCTURED-DATA: '-', msg: ' [Kernel] LOG_PACKET[ACCEPT] IN=WAN SRC=220.127.116.11 DST=18.104.22.168 PROTO=ESP SPI=0xf9861ec ' escaped msg: ' [Kernel] LOG_PACKET[ACCEPT] IN=WAN SRC=22.214.171.124 DST=126.96.36.199 PROTO=ESP SPI=0xf9861ec ' rawmsg: '<4>Oct 02 17:44:08 DSR-500N KERNEL [Kernel] LOG_PACKET[ACCEPT] IN=WAN SRC=188.8.131.52 DST=184.108.40.206 PROTO=ESP SPI=0xf9861ec '
And that is my code:
if hostname == 'DSR-500N' then /var/rsyslog/infolog
But filter doesn't work. Where I'm wrong?
I tried to change filter. I used this code
:$hostname, regex, "*" /var/rsyslog/infolog
this is work. But it works for all hostnames. I'd like to filter this, although if I change to
:$hostname, regex, "^k" /var/rsyslog/infolog
it doesn't work.