I'm having a problem setting up rsyslog to log remote logging data to a specific file. I have two Windows Server 2008 boxes that each have a C# application using NLog.Targets.Syslog which log their debugging data to a linux box. All the logging data is getting written to /var/log/syslog just fine, but I want to have a seperate logfile for each server and the logging data isn't being written to those custom log files.

Here is my setup:


$ModLoad imudp
$UDPServerRun 514

I made a custom conf file in /etc/rsyslog.d


:msg, contains, "AMAZONA-COMPUTERNAME1" /var/log/dbm/server-1.log
& ~
:msg, contains, "AMAZONA-COMPUTERNAME2" /var/log/dbm/server2.log
& ~

*.* /var/log/syslog.log

AMAZONA-COMPUTERNAME1 is the windows computer name of the server. I've also tried IP addresses too and that doesn't work either. What am I missing? the logfiles exist in the path /var/log/dbm/

I'm not getting any errors from rsyslog about this and it happily writes all the remote logging data to /var/log/syslog what am I doing wrong?

On the logging server, I'm running ubuntu on an Amazon EC2 instance.

Here is my NLog config:

<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"

    <add assembly="NLog.Targets.Syslog" />

    <target name="syslog" type="Syslog" syslogserver="server ip here" port="514" facility="Local7"/>

    <logger name="*" minLevel="Trace" appendTo="syslog"/>

Sample log output in /var/log/syslog

Oct 15 18:18:50 AMAZONA-COMPUTERNAME2 NLog: 2012-10-15 18:18:50.2890|DEBUG|myapp.download.excel.ExcelWorkbook|  -- Copied in the data table: 0
Oct 15 18:18:50 AMAZONA-COMPUTERNAME2 NLog: 2012-10-15 18:18:50.2890|DEBUG|myapp.download.excel.ExcelWorkbook|  -- Formatted Header and Footer: 0

1 Answer 1


OK, solved it. I changed the config entry in my custom 22-remote.conf file in /etc/rsyslog.d/ from this:

:msg, contains, "AMAZONA-COMPUTERNAME1" /var/log/dbm/server-1.log
& ~
:msg, contains, "AMAZONA-COMPUTERNAME2" /var/log/dbm/server2.log
& ~

To this:

if $fromhost-ip == '' then /var/log/dbm/server-1.log
& ~
if $fromhost-ip == '' then /var/log/dbm/server2.log
& ~
  • I thought the correct operator was isequal instead of == which is why I couldn't get it to work before.
    – Shawn
    Oct 16, 2012 at 13:40
  • Really? I use :fromhost-ip,isequal,"10.x.x.x" -?Template Where "Template" was previously defined. Oct 16, 2012 at 14:17
  • I'm using rsyslog on ubuntu, maybe there's some quirky differences between linux distros?
    – Shawn
    Oct 17, 2012 at 15:56
  • I realize the difference now, (I think.) :fromhost-ip vs. if $fromhost-ip. Oct 17, 2012 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .