Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am trying to configure rsyslog (Ubuntu 12.04 Server) to log events from a router. I found this old ubuntu forum post which got me most of the way there.

So far I am able to get the events logged from the router. However since I don't them logged in /var/log/syslog I am trying to set up a working filter in /etc/rsyslog.conf to put the logged events in /var/log/linksys.log. This is where I am having trouble.

  • First I tried filtering by the router ip address like this:

    :fromhost-ip, isequal, "192.168.2.1" /var/log/linksys.log
    & ~
    

    This successfully redirects the logs as I wanted, the only problem is now I am not getting any SSHD logs in auth.log. Needless to say this is not acceptable.

  • Next I tried filtering by the router name which appears in every event log:

    :msg,contains, "RV042" /var/log/linksys.log
    & ~
    

    Although this neither logs or blocks anything.

So I am stumped. I have no idea why SSHD is getting filtered with the :fromhost-ip filter. SSHD is local on the machine with rsyslog (192.168.2.2). I am thoroughly frustrated by this, any suggestions are much appreciated.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I figured it out! These links helped:

http://www.rsyslog.com/tag/udp/

http://www.rsyslog.com/doc/multi_ruleset.html

Here's what I did:

Opened up /etc/rsyslog.d/50-default.conf and at the top of the file, before other all of the default filters, I added:

# process remote messages
# define new ruleset and add rules to it:
$RuleSet remote
*.*           /var/log/linksys.log
# only messages not from 192.168.2.1 make it past this point

# bind ruleset to UDP listener
$InputUDPServerBindRuleset remote
# and activate it:
$UDPServerRun 514

# switch back to the default ruleset:
$RuleSet RSYSLOG_DefaultRuleset
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.