Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured rsyslog to log message to a centralised server it's working fine and I'm getting logs in my server's /var/log directory with seperate directory for all the clients based upon their ip addresses (ex: /var/log/ip-address/syslog.log) in it. It generates a file named syslog.log and logs are stored in it my question is can I configure rsyslog to generate all the traffic in different files like http in httpd.log mail in mail.log etc.

share|improve this question
What was the question again? – Ignacio Vazquez-Abrams Jul 9 '13 at 6:11
I want that the logs of clients machine gets categorised like http traffic in http.log etc. right now everything is getting logged in a single file named syslog. So that is my question. – Tarun Jul 9 '13 at 6:19
up vote 2 down vote accepted

In your configuration file, you have the template defined: $template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

When logging all facilities to that template, you are explicitly telling rsyslog to log everything to the file syslog.log. You need to set up seperate facility names for each application you want, ie. on, localhost, define http output as local7, and then on loghost, define a template like:

$template http,"/var/log/$fromhost-ip%/http.log"  
local7.* ?http
share|improve this answer
Couldn't you also use %programname% in the template path? As defined here: – Rick Chatham Mar 16 '15 at 23:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.