6

I want to configure rsyslog on a centralised server so that all the logs of clients are stored at one place now the problem I'm having is I dont know how to implement rsyslog so that it creates logs based on programmes on client machines i.e. like 'httpd' etc. and save them in different files i.e. '/var/log/httpd.log' and while it sends the log to the remote server the files should be saved like '/var/log/ip-address of host/httpd.log' I have these two problems

  1. Logs should be created on programme basis
  2. while logs are transmitted to remote server they should be stored on program basis with different directories for different hosts.

I hope I made my question clear. Please help.

For creating log based on programme I believe I will have to use something like on client side

 if $programname == 'httpd' and $syslogseverity <= '6' then /var/log/httpd.log

 if $programname == 'httpd' and $syslogseverity <= '6' then ~

I also found this question but it doesn't completely solves my problem

how to configure rsyslog

1
  • You got it wrong, the rules you show are to be made on the server side, not on the client. Basically you need to make sure that the clients are sending the messages to the server and then let the server sort them out via rules (to filter the type of message) and templates (to make the server save the messages on different log files). Jul 10, 2013 at 12:56

1 Answer 1

3

You need to first configure your rsyslog server to be able to receive messages from the clients

Edit your server's rsyslog configuration file and create or make sure that the following lines exist:

$ModLoad imuxsock 
$ModLoad imklog
# provides UDP syslog reception. For TCP, load imtcp. For TCP use InputServerRun 514
$ModLoad imudp
# This will save the log file is a separate directory for each client's IP
$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"
#Create a rule for each application you need to filter, ie: httpd messages
$template HTTPD,"/var/log/%fromhost-ip%/httpd.log"

#Create a separate log rule for the specific application
if $programname == 'httpd' then ?HTTPD
&~

#Dump all remaining messages that do not match the filters created into one file
*.* ?FILENAME

After that you need to go to each client and add the following lines to the rsyslog.conf file:

$ModLoad imuxsock
$ModLoad imklog
# Provides UDP forwarding. For TCP use @@server_ip
*.* @server_ip:514

And you should be ready. Everything that the clients send to to server will be filtered with the rules you created and the messages will be saved to the files on each client's IP address folder according to the templates you made on the server side.

3
  • Ok. Thanks for the help now I got a clear picture. Let me try this. :)
    – Tarun
    Jul 10, 2013 at 13:09
  • I might need to tweak it a bit since you did not specify a version of rsyslog or a Ubuntu release, but the principle is the same: client sends all to server, server filters and saves logs. Jul 10, 2013 at 13:14
  • Ya. I was thinking that I will have to configure a few things at client side as well but now the things are clear. One more thing I have used used $fileowner and $filegroup as root, and $PrivDropToUser and $PrivDropToGroup also as root I hope thats not a problem.
    – Tarun
    Jul 10, 2013 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .