We have a syslog server and we have all our servers logging to it.
We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.
Anyone know how to accomplish this?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
So this is how I configured this in
# Log remote hosts to separate log file $template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log" $template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n" :inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat & ~
This traps all log messages received via UDP (
imudp) and puts it in a file whose filename corresponds to the hostname the log message originated from.
I found very nice "how to" that will give you a good head start...