0

I want to assign the syslog local facilities to specific OS, so I can sort the incoming logs on the logserver (e.g. local1 for Windows logs, local2 for RedHat logs, etc). It worked perfectly on Windows, but I'm stuck at my RedHat Systems.

Can I specify on RHEL in rsyslog to which local(1-7) facilities the logs should be sent? (e.g. send all logs of a specific system to .local2)

3
  • Why are you "stuck"? What have you tried? Dec 2, 2015 at 10:17
  • I've tried to find something to add in the /etc/rsyslog.conf, but I didn't find anything like I need. Is it in the "normal" rsyslog config possible to say what local facility should be used when sending to the syslog server?
    – Tem
    Dec 2, 2015 at 10:24
  • rsyslog works just about like it always has. Perhaps you should be specific about the problems you are having. Dec 2, 2015 at 10:25

1 Answer 1

1

You generally cannot do that with a "normal" syslogd because it is against the design of syslog facilities. Windows log forwarders work that way because Windows log events do not have a Unix-like facility and assigning one for the whole server is the easiest solution.

On Unix every log message has its own facility property to distinguish between different services on the same host. Later on even a central log server can identify the daemons with a filter on the combination of host and facility.

You plan would require a syslog forwarder to rewrite the facility. That is certainly possible, e.g. syslog-ng has rewrite rules and larger tools like logstash should support it as well -- but I would advise against that. You would end up with your own site-local design, working against common practices, making every future change to the logging system more difficult.

Not the answer you're looking for? Browse other questions tagged .