I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each
/var/log/syslog file into its own folder based off of the ip address of the server
From my rsyslog server
#/etc/rsyslog.conf $template FILENAME,"/var/log/%fromhost-ip%/syslog.log"
Later, I decided to add more logs to the logging.
From one of my web servers
#/etc/rsyslog.conf $ModLoad imfile $InputFileName /var/log/customFile.log $InputFileTag custom-log $InputFileStateFile myfile $InputFileSeverity info $InputFileFacility local3 $InputFilePollInterval 1 $InputFilePersistStateInterval 1 $InputRunFileMonitor local3.* @@192.168.1.20:514
Now, as expected, the logs from
/var/log/customFile.log are going to the rsyslog server in
What I'd like to happen is ALSO have those logs go to a separate file. So, on my rsyslog server, I'd like my
/var/log/192.168.1.x/ directory to still have a syslog.log file, with all logs from that server, but also have a customLog.log file that is just the logs from the imfile info from /var/log/customFile.log
Is there any way to separate this out once it's on the rsyslog server?