Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've set up a logging server using rsyslog with relp. It works just fine as far as receiving remote logs and placing them in /var/spool/rsyslog.

My problem is: most of these messages are appearing in my /var/log/messages file as well, which can get fairly huge, fairly fast.

My config on the logging server:

    #### MODULES ####

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)

# RELP config
$ModLoad imrelp
$InputRELPServerRun 2514

#### GLOBAL DIRECTIVES ####

# Filter duplicated messages
$RepeatedMsgReduction on

# Set the default permissions for all log files.
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

# Where to place spool files
$WorkDirectory /var/spool/rsyslog

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# global templates
# DONT CHANGE UNLESS YOU KNOW WHAT YOU ARE DOING
$ActionFileDefaultTemplate RSYSLOG_ForwardFormat
$template precise,"%syslogpriority% %syslogfacility% %timegenerated% %HOSTNAME% %syslogtag% %msg%\n"
$ActionFileDefaultTemplate precise

# This should place all remote log items into /var/spool/rsyslog
$template RemoteHost,"/var/spool/rsyslog/%programname%.log"

# My brain says: this prevents anything coming in from a remote host from
# being written in /var/log/whatever - MY BRAIN LIES TO ME!
if ($hostname != 'my.server.name') then ?RemoteHost
&~

My reading of the man page says that the hostname check and the "ampersand tilde" should prevent remote stuff from tainting my logfiles.

Clues?

DISTRIB_DESCRIPTION="Ubuntu 12.04.3 LTS"

share|improve this question

1 Answer 1

i am not sure if you are able to use hostnames at that point.

personally i used $fromip == 'x.x.x.x' as a condition for different filenames.

below is a nice example which works for my setup , though it might be a problem if you have a lot of different ip ranges.

this is copied from

http://www.rsyslog.com/tag/more-complex-scenarios/

Storing Messages from a Remote System into a specific File Tuesday, February 23rd, 2010

This is a log-consolidation scenario. There exist at least two systems, a server and at least one client. The server is meant to gather log data from all the clients. Clients may (or may not) process and store messages locally. If they do, doesn’t matter here. See recipe Sending Messages to a Remote Syslog Server for how to configure the clients.

Messages from remote hosts in the 192.0.1.x network shall be written to one file and messages from remote hosts in the 192.0.2.x network shallbe written to another file. Things to think about

TCP recpetion is not a build-in capability. You need to load the imtcp plugin in order to enable it. This needs to be done only once in rsyslog.conf. Do it right at the top.

Note that the server port address specified in $InputTCPServerRun must match the port address that the clients send messages to. Config Statements

$ModLoad imtcp
$InputTCPServerRun 10514
# do this in FRONT of the local/regular rules
if $fromhost-ip startswith '192.0.1.' then /var/log/network1.log
& ~
if $fromhost-ip startswith '192.0.2.' then /var/log/network2.log
& ~
# local/regular rules, like
*.* /var/log/syslog.log
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.