0

I need some help configuring my rsyslog service. I was wondering if it was possible to configure remote logging based on incoming ports. For example:

If the logs are coming from 172.28.132.43 then put the logs in the /var/log/enviromux/ directory. If the logs are coming from 172.28.132.43:9191 put the logs in the /var/log/sierra/ directory. (port 9191)

This is my configuration so far, but there are some errors on line 4 &5. Can anyone tell me what I do wrong:

1 $template remote-sierras,"/var/log/sierra/%FROMHOST%/%programname%.log"
2 $template remote-enviromux, "/var/log/enviromux/%FROMHOST%.log"
3 if($fromhost=="ZABBIX") then stop
4 if($fromhost=="*:9191") then *.* ?remote-sierras & stop
5 *.* ?remote-enviromux & stop

My version off rsyslogis 8.32.0 and I run it on Ubuntu version 18.04.3 LTS.

Can anyone help me with this? Thanks in advance!

1 Answer 1

0

The documentation seems to suggest that the fromhost property does not include the source port number.

What you could try instead is use one of the other properties to filter these messages. For instance you could try something like if($programname == "sierras")..., if ($msg contains "sierras"), or something similar.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .