0

I have a central syslog server (ubuntu 14.04 server), that I've set up to take in logs from many servers.

This server has a storage hard drive that is very large, mounted at /home/username/logs

I'd like to send the rsyslog logs to that location, with a different directory for each server.

Right now, I have all of that working except it will only store the files in the /var/log directory.

My /etc/rsyslog.conf has these settings to enable the storage of log files from different servers based on their ip

/etc/rsyslog.conf

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

# This one is the template to generate the log filename dynamically, depending on the client's IP address.
$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

# Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.
*.* ?FILENAME

# Enable non-kernel facility klog messages
$KLogPermitNonKernelFacility on

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

The lines below, specifically are what I want to have working

# This one is the template to generate the log filename dynamically, depending on the client's IP address.
$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

# Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.
*.* ?FILENAME

but instead of having the $template FILENAME,"var/log/....", I'd like it to be something similar to $template FILENAME,"/home/username/logs/ "

What is stopping me from changing the directory to something outside of /var/log, and how can I fix this?

I know I can probably mount that drive somewhere under /var/log, but I'm curious now.

  • AppArmour? rsyslogd has no restrictions of it's own. – Ricky Beam Dec 10 '15 at 21:38
  • I don't have appArmor setup, that I know of. It must be another problem I'm not seeing. Glad to know rsyslog doesn't restrict that though. – trueCamelType Dec 10 '15 at 21:40
  • Is the directory mounted before rsyslog starts? Directory permissions? – Ricky Beam Dec 10 '15 at 21:44
  • I'll be able to check tomorrow and update this. I know it is mounted before rsyslog starts, and I thought the permissions were the same, but I may have accidentally created the directory as another user. Thanks – trueCamelType Dec 10 '15 at 22:32
  • 1
    @trueCamelType Can you add that as an answer? – Ken Sharp Dec 19 '15 at 15:09
0

When I created the directory that I wanted to store the syslog data in, I ran the command as root. Once I changed the owner to syslog, everything worked fine.

Ugh, creating a SE question from a permissions problem is embarrassing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.