3

I recently setup one of our servers as an rsyslog server. I now have our firewall setup to log everything to that rsyslog server.

But there doesn't seem to be an organization of the logs. All the firewall logs are just being dumped into the /var/log/messages on the rsyslog server. I guess I was maybe expecting them to at least be in a machine specific log file or directory.

How can I organize the incoming logging? If I setup 20 servers to all log everything to a central rsyslog server, I really don't want everything being dumped into one big file or a few files. How can I setup rsyslog to tell it where to log what? Like if all the logs for a specific server were in it's own directory/file, etc... Is this possible?

4

Rsyslog has a pretty good configuration system which allows you to create logs in many different ways. Check the online docs.

Specifically you may want to check out the configuration samples. This recipe may be close to what you want.

http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory

| improve this answer | |
  • Excellent. The appears to be what I'm looking for. Thanks! – Jake Wilson Jan 5 '11 at 22:03
  • I've copy/pasted that exact configuration into my /etc/rsyslog.conf and restarted rsyslogd w/o error, but I'm still not getting any logs for other servers showing up anywhere but in messages. Any thoughts? – Jake Wilson Feb 10 '11 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.