We have a syslog server and we have all our servers logging to it.
We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.
Anyone know how to accomplish this?
asked Apr 26, 2012 at 19:12
Add a comment
|
2 Answers
So this is how I configured this in rsyslog.conf:
# Log remote hosts to separate log file
$template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
& ~
This traps all log messages received via UDP (imudp) and puts it in a file whose filename corresponds to the hostname the log message originated from.
answered May 8, 2012 at 13:52
-
Thank you for the example using inputname. Half a dozen examples I found all tried matching on $hostname and the like... and none of them worked reliably for this :)– allaryinMar 25, 2015 at 17:00
-
HI, this works, expcept the 'last message repeated x times' messages end up in /var/log/remote-hosts/.log. Aug 9, 2016 at 9:10
I found very nice "how to" that will give you a good head start...
How to Setup Rsyslog Remote Logging on Linux (Central Log Server)
-
Edited question to clarify what I want. Let me know if that helps. Apr 26, 2012 at 19:56
-
-
1I believe the submitter is looking for a rule to use on the receiving syslog server to dump messages into files.– user9565Apr 26, 2012 at 20:04
-
That's correct. My apologies @alexus for not being clear initially. Apr 26, 2012 at 20:06
-