We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?


Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want.

Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. Based on the information in that page, here's an example of how you could put messages starting with the string "application1" into /var/log/application1:

if $msg startswith 'application1' then /var/log/application1

You can also filter explicitly on the program name, if your application sets this correctly:

if $programname == 'application1' then /var/log/application1

You can perform all sorts of complex filtering in your rsyslog.conf; read through the documentation for more information and examples.

EDIT: rsyslog can use templates to create separate files for each server. Something like the following should put all log messages into separate files for each hostname. (This is lifted from the manpage.)

$template DynFile,"/var/log/system-%HOSTNAME%.log
*.*                             ?DynFile

The following is similar but does not log debug messages. It also uses the connection hostname rather than the message hostname. (This is based on what I developed to log output from an Obi100.)

$template HostFormat,"%timegenerated% %fromhost% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$template HostFile,"/var/log/system-%fromhost%.log
if $syslogseverity < 7 then -HostFile;HostFormat

Read the manpage and documentation if you have more complex needs, or want to understand what the above do.

  • How do you configure this in rsyslog.conf? – Belmin Fernandez Apr 19 '12 at 23:16
  • What exactly do you want to configure? I'm not even sure I've answered your question, because you don't need a different facility for each application unless you're looking to put the messages from each application in a separate log file...but it only makes sense to do this using syslog if you're sending them remotely; otherwise, you might as well just direct output from our application directly to a file. Maybe you can elaborate on exactly what you're trying to do? – larsks Apr 19 '12 at 23:18
  • They are being sent remotely. The appliances are sending it to an rsyslog server. I want to direct the data to separate log files. – Belmin Fernandez Apr 20 '12 at 13:15

Filter by host name. (Each appliance should have its own hostname). If you want you can listen on multiple ports and handle each port separately.

Facilities are designed to handle message categories like authorization, mail, printer, ftp, etc. As UUCP isn't used much anymore you could likely use it for your own uses. Their may be other unused facilities in your configuration. However, you are better off using standard facilities values, and filtering by other data.

There are 24 facilities as they are names for bits in a bit mask. This makes aggregating arbitrary sets of facilities in the same log. The protocol is specified in RFC 5424.

The other field is severity. Normally logs contain all logs at or above a given severity. (More severe priorities have lower values, so the normal comparison is less than or equal to the selected priority.) However messages of a given facility can be selected, as is often done for the debug log which collects debug messages for all facilities.

You may want to aggregate data for some facilities in the same log regardless of originating appliance. It is common to log the same message to multiple log files.

  • RFC 5424 defines 24 facilities. – adaptr Apr 20 '12 at 13:37
  • @adaptr: Did a rough count from a man page instead of checking the RFC. A close view of the RFC shows only 20 unique purposes due to use of multiple facility bits for clock and authentication messages. – BillThor Apr 20 '12 at 21:34
  • How they're used in practice doesn't change that the protocol is limited to 192 unique values. If you violate THAT, it's not going to be syslog anymore. – adaptr Apr 22 '12 at 22:47
  • @adaptr: If the facility bit is not used in the environment, then it can be used for a non-standard purpose without collision. I don't recommend it, but it is possible. – BillThor Apr 22 '12 at 23:06
  • I agree, but it's a big if. – adaptr Apr 23 '12 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.