We have a syslog server and we have all our servers logging to it.

We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.

Anyone know how to accomplish this?

2 Answers 2


So this is how I configured this in rsyslog.conf:

# Log remote hosts to separate log file
$template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
& ~

This traps all log messages received via UDP (imudp) and puts it in a file whose filename corresponds to the hostname the log message originated from.

  • Thank you for the example using inputname. Half a dozen examples I found all tried matching on $hostname and the like... and none of them worked reliably for this :)
    – allaryin
    Mar 25, 2015 at 17:00
  • HI, this works, expcept the 'last message repeated x times' messages end up in /var/log/remote-hosts/.log.
    – dan carter
    Aug 9, 2016 at 9:10

I found very nice "how to" that will give you a good head start...

How to Setup Rsyslog Remote Logging on Linux (Central Log Server)

  • Edited question to clarify what I want. Let me know if that helps. Apr 26, 2012 at 19:56
  • my answer will do exactly that
    – alexus
    Apr 26, 2012 at 19:58
  • 1
    I believe the submitter is looking for a rule to use on the receiving syslog server to dump messages into files.
    – user9565
    Apr 26, 2012 at 20:04
  • That's correct. My apologies @alexus for not being clear initially. Apr 26, 2012 at 20:06
  • Pretty sparse on that link. Oct 8, 2013 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .