We have a syslog server and we have all our servers logging to it.

We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.

Anyone know how to accomplish this?

2 Answers 2


So this is how I configured this in rsyslog.conf:

# Log remote hosts to separate log file
$template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
& ~

This traps all log messages received via UDP (imudp) and puts it in a file whose filename corresponds to the hostname the log message originated from.

  • Thank you for the example using inputname. Half a dozen examples I found all tried matching on $hostname and the like... and none of them worked reliably for this :)
    – allaryin
    Mar 25, 2015 at 17:00
  • HI, this works, expcept the 'last message repeated x times' messages end up in /var/log/remote-hosts/.log.
    – dan carter
    Aug 9, 2016 at 9:10

I found very nice "how to" that will give you a good head start...

How to Setup Rsyslog Remote Logging on Linux (Central Log Server)

  • Edited question to clarify what I want. Let me know if that helps. Apr 26, 2012 at 19:56
  • my answer will do exactly that
    – alexus
    Apr 26, 2012 at 19:58
  • 1
    I believe the submitter is looking for a rule to use on the receiving syslog server to dump messages into files.
    – user9565
    Apr 26, 2012 at 20:04
  • That's correct. My apologies @alexus for not being clear initially. Apr 26, 2012 at 20:06
  • Pretty sparse on that link. Oct 8, 2013 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.