I'm having a problem setting up rsyslog to log remote logging data to a specific file. I have two Windows Server 2008 boxes that each have a C# application using NLog.Targets.Syslog which log their debugging data to a linux box. All the logging data is getting written to /var/log/syslog just fine, but I want to have a seperate logfile for each server and the logging data isn't being written to those custom log files.

Here is my setup:


$ModLoad imudp
$UDPServerRun 514

I made a custom conf file in /etc/rsyslog.d


:msg, contains, "AMAZONA-COMPUTERNAME1" /var/log/dbm/server-1.log
& ~
:msg, contains, "AMAZONA-COMPUTERNAME2" /var/log/dbm/server2.log
& ~

*.* /var/log/syslog.log

AMAZONA-COMPUTERNAME1 is the windows computer name of the server. I've also tried IP addresses too and that doesn't work either. What am I missing? the logfiles exist in the path /var/log/dbm/

I'm not getting any errors from rsyslog about this and it happily writes all the remote logging data to /var/log/syslog what am I doing wrong?

On the logging server, I'm running ubuntu on an Amazon EC2 instance.

Here is my NLog config:

<?xml version="1.0" encoding="utf-8" ?>
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd"

    <add assembly="NLog.Targets.Syslog" />

    <target name="syslog" type="Syslog" syslogserver="server ip here" port="514" facility="Local7"/>

    <logger name="*" minLevel="Trace" appendTo="syslog"/>

Sample log output in /var/log/syslog

Oct 15 18:18:50 AMAZONA-COMPUTERNAME2 NLog: 2012-10-15 18:18:50.2890|DEBUG|myapp.download.excel.ExcelWorkbook|  -- Copied in the data table: 0
Oct 15 18:18:50 AMAZONA-COMPUTERNAME2 NLog: 2012-10-15 18:18:50.2890|DEBUG|myapp.download.excel.ExcelWorkbook|  -- Formatted Header and Footer: 0

OK, solved it. I changed the config entry in my custom 22-remote.conf file in /etc/rsyslog.d/ from this:

:msg, contains, "AMAZONA-COMPUTERNAME1" /var/log/dbm/server-1.log
& ~
:msg, contains, "AMAZONA-COMPUTERNAME2" /var/log/dbm/server2.log
& ~

To this:

if $fromhost-ip == '' then /var/log/dbm/server-1.log
& ~
if $fromhost-ip == '' then /var/log/dbm/server2.log
& ~
  • I thought the correct operator was isequal instead of == which is why I couldn't get it to work before. – Shawn Oct 16 '12 at 13:40
  • Really? I use :fromhost-ip,isequal,"10.x.x.x" -?Template Where "Template" was previously defined. – Aaron Copley Oct 16 '12 at 14:17
  • I'm using rsyslog on ubuntu, maybe there's some quirky differences between linux distros? – Shawn Oct 17 '12 at 15:56
  • I realize the difference now, (I think.) :fromhost-ip vs. if $fromhost-ip. – Aaron Copley Oct 17 '12 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.