Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having a problem setting up rsyslog to log remote logging data to a specific file. I have two Windows Server 2008 boxes that each have a C# application using NLog.Targets.Syslog which log their debugging data to a linux box. All the logging data is getting written to /var/log/syslog just fine, but I want to have a seperate logfile for each server and the logging data isn't being written to those custom log files.

Here is my setup:


$ModLoad imudp
$UDPServerRun 514

I made a custom conf file in /etc/rsyslog.d


:msg, contains, "AMAZONA-COMPUTERNAME1" /var/log/dbm/server-1.log
& ~
:msg, contains, "AMAZONA-COMPUTERNAME2" /var/log/dbm/server2.log
& ~

*.* /var/log/syslog.log

AMAZONA-COMPUTERNAME1 is the windows computer name of the server. I've also tried IP addresses too and that doesn't work either. What am I missing? the logfiles exist in the path /var/log/dbm/

I'm not getting any errors from rsyslog about this and it happily writes all the remote logging data to /var/log/syslog what am I doing wrong?

On the logging server, I'm running ubuntu on an Amazon EC2 instance.

Here is my NLog config:

<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns=""

    <add assembly="NLog.Targets.Syslog" />

    <target name="syslog" type="Syslog" syslogserver="server ip here" port="514" facility="Local7"/>

    <logger name="*" minLevel="Trace" appendTo="syslog"/>

Sample log output in /var/log/syslog

Oct 15 18:18:50 AMAZONA-COMPUTERNAME2 NLog: 2012-10-15 18:18:50.2890|DEBUG||  -- Copied in the data table: 0
Oct 15 18:18:50 AMAZONA-COMPUTERNAME2 NLog: 2012-10-15 18:18:50.2890|DEBUG||  -- Formatted Header and Footer: 0
share|improve this question
up vote 2 down vote accepted

OK, solved it. I changed the config entry in my custom 22-remote.conf file in /etc/rsyslog.d/ from this:

:msg, contains, "AMAZONA-COMPUTERNAME1" /var/log/dbm/server-1.log
& ~
:msg, contains, "AMAZONA-COMPUTERNAME2" /var/log/dbm/server2.log
& ~

To this:

if $fromhost-ip == '' then /var/log/dbm/server-1.log
& ~
if $fromhost-ip == '' then /var/log/dbm/server2.log
& ~
share|improve this answer
I thought the correct operator was isequal instead of == which is why I couldn't get it to work before. – Shawn Oct 16 '12 at 13:40
Really? I use :fromhost-ip,isequal,"10.x.x.x" -?Template Where "Template" was previously defined. – Aaron Copley Oct 16 '12 at 14:17
I'm using rsyslog on ubuntu, maybe there's some quirky differences between linux distros? – Shawn Oct 17 '12 at 15:56
I realize the difference now, (I think.) :fromhost-ip vs. if $fromhost-ip. – Aaron Copley Oct 17 '12 at 17:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.