Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to get my local /var/log/syslog file under control. My current structure is to log remote files to /var/log/juniper/syslog/%fromhost-ip%/syslog.log. Below are my configurations.

rsyslog.conf

/etc# cat rsyslog.conf
#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging $ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception $ModLoad imudp $UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
# $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages $RepeatedMsgReduction on

#
# Set the default permissions for all log files.
# $FileOwner syslog $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $PrivDropToUser syslog $PrivDropToGroup syslog

#
# Where to place spool files
# $WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
# $IncludeConfig /etc/rsyslog.d/*.conf

################
#### RULES #####
################

# This one is the template to generate the log filename dynamically, depending on the client's IP address. 
$template JUNIPER,"/var/log/juniper/syslog/%fromhost-ip%/syslog.log"

# Log all messages to the dynamically formed file. Now each clients log will be under a separate directory which is formed by the template FILENAME.
*.* ?JUNIPER

/etc#

50-default.conf

/etc/rsyslog.d# cat 50-default.conf
#  Default rules for rsyslog.
#
#                       For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
#daemon.*                       -/var/log/daemon.log
kern.*                          -/var/log/kern.log
#lpr.*                          -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#user.*                         -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info                      -/var/log/mail.info
#mail.warn                      -/var/log/mail.warn
mail.err                        /var/log/mail.err

#
# Logging for INN news system.
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
#*.=debug;\
#       auth,authpriv.none;\
#       news.none;mail.none     -/var/log/debug
#*.=info;*.=notice;*.=warn;\
#       auth,authpriv.none;\
#       cron,daemon.none;\
#       mail,news.none          -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                                :omusrmsg:*

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#       news.=crit;news.=err;news.=notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole
/etc/rsyslog.d#

*.* ?JUNIPER is effectively logging everything from everyone (including locahost) to the template $template JUNIPER,"/var/log/juniper/syslog/%fromhost-ip%/syslog.log”.

*.*;auth,authpriv.none -/var/log/syslog is then doubling my log files to the regular /var/log/syslog file.

How can I filter these results down so that the localhost is logging to it’s original location (/var/log/syslog) and remote clients only log to their respective location (/var/log/juniper/syslog/%fromhost-ip%/syslog.log)?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

To remediate this issue, I commented out $IncludeConfig /etc/rsyslog.d/*.conf and added in 2 IP-based filter conditions.

if $fromhost-ip == '127.0.0.1' then /var/log/syslog 
if $fromhost-ip != '127.0.0.1' then ?JUNIPER

Essentially, this sends everything coming from localhost to /var/log/syslog. Remote host logs are then sent to their respective dynamic directories.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.