2

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server

From my rsyslog server

#/etc/rsyslog.conf
$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

Later, I decided to add more logs to the logging.

From one of my web servers

#/etc/rsyslog.conf
$ModLoad imfile
$InputFileName /var/log/customFile.log
$InputFileTag custom-log
$InputFileStateFile myfile
$InputFileSeverity info
$InputFileFacility local3
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
local3.* @@192.168.1.20:514

Now, as expected, the logs from /var/log/customFile.log are going to the rsyslog server in /var/log/192.168.1.x/syslog.log.

What I'd like to happen is ALSO have those logs go to a separate file. So, on my rsyslog server, I'd like my /var/log/192.168.1.x/ directory to still have a syslog.log file, with all logs from that server, but also have a customLog.log file that is just the logs from the imfile info from /var/log/customFile.log

Is there any way to separate this out once it's on the rsyslog server?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.