I have configured rsyslog to log message to a centralised server it's working fine and I'm getting logs in my server's /var/log directory with seperate directory for all the clients based upon their ip addresses (ex: /var/log/ip-address/syslog.log) in it. It generates a file named syslog.log and logs are stored in it my question is can I configure rsyslog to generate all the traffic in different files like http in httpd.log mail in mail.log etc.
-
What was the question again?– Ignacio Vazquez-AbramsJul 9, 2013 at 6:11
-
I want that the logs of clients machine gets categorised like http traffic in http.log etc. right now everything is getting logged in a single file named syslog. So that is my question.– TarunJul 9, 2013 at 6:19
Add a comment
|
1 Answer
In your configuration file, you have the template defined: $template FILENAME,"/var/log/%fromhost-ip%/syslog.log"
When logging all facilities to that template, you are explicitly telling rsyslog to log everything to the file syslog.log. You need to set up seperate facility names for each application you want, ie. on, localhost, define http output as local7, and then on loghost, define a template like:
$template http,"/var/log/$fromhost-ip%/http.log"
local7.* ?http
-
Couldn't you also use %programname% in the template path? As defined here: rsyslog.com/doc/property_replacer.html Mar 16, 2015 at 23:26