Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

ɪ need to save all the logs but here logs are combined together. So I need to grep the logs with ipadres and client id, and each IP's should be saved in a different file.

I am using RSYSlog. So how can I grep below logs with client ip and save each client logs in each file?

My rsyslog.conf (clientl server):

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#           For more information see
#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


\# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
\# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad imuxsock

$ModLoad imklog

# Provides UDP forwarding. The IP is the server's IP address
*.* @192.168.1.84:514 

# Provides TCP forwarding. But the current server runs on UDP
# *.* @@192.168.1.27:514

$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
$ActionFileDefaultTemplate precise
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
root@ubuntu:/etc# 

MY Central server 
===================

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#           For more information see
#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

\# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
\# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

$ModLoad imudp #loads the udp module
$UDPServerRun 514 # defines what port to listen on

$EscapeControlCharactersOnReceive off # Prevents rsyslog from turning tab into #011

$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
$ActionFileDefaultTemplate precise
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

local1.* /var/log/sadon.log # Specifies that all messages for facility "local1" get written to wowza log file



Dec 12 22:26:13 cloud1 proxy 100.100.1.1 100.100.1.1 12/Dec/2013/16/56/13 GET /favicon.ico HTTP/1.0 412 - Mozilla/5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit/537.31%20%28KHTML%2C%20like%20Gecko%29%20Chrome/26.0.1410.63%20Safari/537.31 - - 7 - txb786a0cbd4ca4286b6169c5510e4e921 - 0.0002 -

Dec 12 22:26:58 cloud1 proxy 100.100.1.17 100.100.1.17 12/Dec/2013/16/56/58 GET /v1/AUTH_4c36d514-afc9-4f2e-a017-6476df84f695/a/a.jpg HTTP/1.0 200 - Mozilla/5.0%20%28X11%3B%20Linux%20i686%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/31.0.1650.63%20Safari/537.36 - - 605868 - txd23377ef34de44e081c56dd07d3f66fa - 2.6376 -

Dec 12 22:26:58 cloud1 proxy 100.100.1.17 100.100.1.17 12/Dec/2013/16/56/58 GET /favicon.ico HTTP/1.0 412 - Mozilla/5.0%20%28X11%3B%20Linux%20i686%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/31.0.1650.63%20Safari/537.36 - - 7 - tx20934ca545654f729d9b6af12b244f2a - 0.0002 -

Dec 12 22:59:29 cloud1 proxy 100.100.176.22 100.100.176.22 12/Dec/2013/17/29/29 GET / HTTP/1.0 404 - - - - 70 - tx5e04cadd1ba145adaffebafbb395fd1b - 0.0003 -
Dec 13 02:47:55 cloud1 proxy 121.56.217.206 121.56.217.206 12/Dec/2013/21/17/55 GET http%253A//www.baidu.com/robots.txt HTTP/1.0 404 - Mozilla/4.0%20%28compatible%3B%20Win32%3B%20WinHttp.WinHttpRequest.5%29 - - 70 - tx4a7e8abf3b2b43d29c208258ce8399c8 - 0.0003 -

Dec 13 03:25:57 cloud1 proxy 100.100.8.235 100.100.8.235 12/Dec/2013/21/55/57 HEAD / HTTP/1.0 404 - - - - - - tx9f28783556494fc6b58eeb6ae31d352a - 0.0004 -

Dec 13 05:13:43 cloud1 proxy 100.100.14.88 100.100.14.88 12/Dec/2013/23/43/43 GET http%253A//www.qq.com/ HTTP/1.0 404 - Mozilla/4.0%20%28compatible%3B%20MSIE%204.01%3B%20Windows%2098%29 - - 70 - txc564961a15184049812d0a5026f8c694 - 0.0003 -

Dec 13 07:07:16 cloud1 proxy 100.100.14.88 100.100.14.88 13/Dec/2013/01/37/16 GET http%253A//www.qq.com/ HTTP/1.0 404 - Mozilla/4.0%20%28compatible%3B%20MSIE%204.01%3B%20Windows%2098%29 - - 70 - tx835d0cff6cc04f5e9d1e9353a16ccc7b - 0.0003 -
Dec 13 08:29:53 cloud1 proxy SIGTERM received
Dec 13 08:29:53 cloud1 proxy Exited
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.