1

I have configured rsyslog to log message to a centralised server it's working fine and I'm getting logs in my server's /var/log directory with seperate directory for all the clients based upon their ip addresses (ex: /var/log/ip-address/syslog.log) in it. It generates a file named syslog.log and logs are stored in it my question is can I configure rsyslog to generate all the traffic in different files like http in httpd.log mail in mail.log etc.

2
  • What was the question again? Jul 9, 2013 at 6:11
  • I want that the logs of clients machine gets categorised like http traffic in http.log etc. right now everything is getting logged in a single file named syslog. So that is my question.
    – Tarun
    Jul 9, 2013 at 6:19

1 Answer 1

2

In your configuration file, you have the template defined: $template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

When logging all facilities to that template, you are explicitly telling rsyslog to log everything to the file syslog.log. You need to set up seperate facility names for each application you want, ie. on, localhost, define http output as local7, and then on loghost, define a template like:

$template http,"/var/log/$fromhost-ip%/http.log"  
local7.* ?http
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .