Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side.

I added this line at the end of /etc/rsyslog.conf:

if $fromhost-ip == '' then /var/log/clientA.log

But it doesn't work at all (even if I replace == by != which is really weird). Of course I didn't forget to restart the service.

Any idea welcome.

share|improve this question

Our config has some extra error checking in it preventing random hosts from generating logs.

# Templates                    
$template RemoteHost,"/data/log/remote/%HOSTNAME%/%$YEAR%/%$MONTH%-%$DAY%.log"
$template Garbage,"/data/log/remote/GARBAGE/%HOSTNAME%/%$YEAR%/%$MONTH%-%$DAY%.log"

# Discard SNMPD Connection Messages
if $programname == 'snmpd' and ( $msg contains 'Connection from UDP' or $msg contains 'Received SNMP packet(s) from UDP' ) then ~

# Archival Storage
#    All Messages, locally and remote stored to these rules
if $hostname contains '' or $hostname contains '' or $hostname contains '.local' then { 
  *.* ?RemoteHost 
} else { 
  *.* ?Garbage

# If not sourced locally, stop processing message.
:source , !isequal , "syslog1" ~
share|improve this answer
It's not the point of my question. I can receive messages from the client which is fine so far. – Guilhem Soulas Mar 25 '14 at 9:50
Look at the first template line? That specifically breaks your data up by host. – dmourati Mar 25 '14 at 16:23
up vote 0 down vote accepted

It's working now. It was a permission issue. I did touch and chmod on the log file to fix it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.