We have a syslog server and we have all our servers logging to it.

We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.

Anyone know how to accomplish this?


So this is how I configured this in rsyslog.conf:

# Log remote hosts to separate log file
$template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
& ~

This traps all log messages received via UDP (imudp) and puts it in a file whose filename corresponds to the hostname the log message originated from.

| improve this answer | |
  • Thank you for the example using inputname. Half a dozen examples I found all tried matching on $hostname and the like... and none of them worked reliably for this :) – allaryin Mar 25 '15 at 17:00
  • HI, this works, expcept the 'last message repeated x times' messages end up in /var/log/remote-hosts/.log. – dan carter Aug 9 '16 at 9:10

I found very nice "how to" that will give you a good head start...

How to Setup Rsyslog Remote Logging on Linux (Central Log Server)

| improve this answer | |
  • Edited question to clarify what I want. Let me know if that helps. – Belmin Fernandez Apr 26 '12 at 19:56
  • my answer will do exactly that – alexus Apr 26 '12 at 19:58
  • 1
    I believe the submitter is looking for a rule to use on the receiving syslog server to dump messages into files. – user9565 Apr 26 '12 at 20:04
  • That's correct. My apologies @alexus for not being clear initially. – Belmin Fernandez Apr 26 '12 at 20:06
  • Pretty sparse on that link. – Fiasco Labs Oct 8 '13 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.