Really perplexed at what happened. I've had rsyslogd running on a Centos 6.5 server for a while now logging for remote hosts to a special folder /data/rsyslog. Yesterday I setup our firewall to start logging and it was working fine except the logs were large for that firewall, so I decided to setup a logrotate job for it to rotate. This morning all the logs rotated, but it was no longer logging to any files in my rsyslog folder for any hosts. At first I thought something was wrong with creating a new file, but what I found is all the remote logs now going to the standard /var/log/message file. This is my rsyslog.conf file:

[root@backup1 etc]# cat rsyslog.conf
# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514


# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none        /var/log/messages

# The authpriv file has restricted access.
authpriv.*      /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit  /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

$template Secure_log,"/data/rsyslog/%fromhost%.secure"
$template Message_log,"/data/rsyslog/%fromhost%.message"

That is the way the file was, but I found that I don't have an action, so I added the following line to the end to test:

*.* ?Message_log

And now all goes into their hostname files as expected into that folder, but its also logging to /var/log folder as well. I guess the line above is doing that with /var/log/messages. I have upgraded to rsyslogd version 7 in the process of trying to get this working. Not sure what happened, but just trying to get it working from scratch now and can't seem to track down the proper configuration to log remote hosts to only that special folder. Can someone help?

  • when logrotate created the new log file - did it do it with permissions that rsyslog could write to? Dec 4, 2015 at 19:06
  • Not sure, I don't think that was a problem and never had any problem getting it to write to the folder when an action is present. I'm replace those couple of lines in rsyslog.conf to: .info;mail.none;authpriv.none;cron.none ?Message_log authpriv. ?Secure_log Now working, will try logrotate again now to see if same thing happens. Dealing with the issue, I found some posts regarding setup, gonna try truncate? Any other gotchas you know of?
    – rwfitzy
    Dec 4, 2015 at 21:55

1 Answer 1


If you want to make sure that your messages will be written in a specific file, you need to filter your message.

When you use *.* ?Message_log at the end of file, the message will pass before in *.info;mail.none;authpriv.none;cron.none /var/log/messages, as you expected.

Before $IncludeConfig /etc/rsyslog.d/*.conf, you need to declare your template, and use an if expression to filter your message. Try doing the following:

$template Secure_log,"/data/rsyslog/%fromhost%.secure"
$template Message_log,"/data/rsyslog/%fromhost%.message"
if ($fromhost-ip == "THE IP OF THE ONE SENDING MESSAGES") then {
  *.* ?Message_log

This will log the wanted messages in the file you specified, and discard them with the stop, so it won't be written elsewhere.

An alternative to it is creating a file in /etc/rsyslog.d/, like 00-example.conf, to make your configurations more organized. But make sure that the number of the file need to be lower than the default file(that is 50).

  • Exactly what I was looking for, thanks! Have another question about the configuration file you suggested. Since I want all hosts other than the localhost to go to the special folder, I setup my rule replacing '$fromhost-ip == "THE IP OF THE ONE SENDING MESSAGES"' with '$fromhost != "backup1". Guess I'll find out tomorrow, but not sure if that operator is valid for not equal to? I used the localhost name of backup1, which is the name rsyslog is currently using to name files for the localhost, because I'm not sure if I should be using or static IP assigned.
    – rwfitzy
    Dec 7, 2015 at 15:08
  • I believe this one is not a valid one. Try using $hostname instead. Dec 7, 2015 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.