Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

ɪ need to save all the logs but here logs are combined together. So I need to grep the logs with ipadres and client id, and each IP's should be saved in a different file.

I am using RSYSlog. So how can I grep below logs with client ip and save each client logs in each file?

My rsyslog.conf (clientl server):

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#           For more information see
#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


\# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
\# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad imuxsock

$ModLoad imklog

# Provides UDP forwarding. The IP is the server's IP address
*.* @192.168.1.84:514 

# Provides TCP forwarding. But the current server runs on UDP
# *.* @@192.168.1.27:514

$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
$ActionFileDefaultTemplate precise
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
root@ubuntu:/etc# 

MY Central server 
===================

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#           For more information see
#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

\# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
\# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

$ModLoad imudp #loads the udp module
$UDPServerRun 514 # defines what port to listen on

$EscapeControlCharactersOnReceive off # Prevents rsyslog from turning tab into #011

$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
$ActionFileDefaultTemplate precise
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

local1.* /var/log/sadon.log # Specifies that all messages for facility "local1" get written to wowza log file



Dec 12 22:26:13 cloud1 proxy 100.100.1.1 100.100.1.1 12/Dec/2013/16/56/13 GET /favicon.ico HTTP/1.0 412 - Mozilla/5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit/537.31%20%28KHTML%2C%20like%20Gecko%29%20Chrome/26.0.1410.63%20Safari/537.31 - - 7 - txb786a0cbd4ca4286b6169c5510e4e921 - 0.0002 -

Dec 12 22:26:58 cloud1 proxy 100.100.1.17 100.100.1.17 12/Dec/2013/16/56/58 GET /v1/AUTH_4c36d514-afc9-4f2e-a017-6476df84f695/a/a.jpg HTTP/1.0 200 - Mozilla/5.0%20%28X11%3B%20Linux%20i686%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/31.0.1650.63%20Safari/537.36 - - 605868 - txd23377ef34de44e081c56dd07d3f66fa - 2.6376 -

Dec 12 22:26:58 cloud1 proxy 100.100.1.17 100.100.1.17 12/Dec/2013/16/56/58 GET /favicon.ico HTTP/1.0 412 - Mozilla/5.0%20%28X11%3B%20Linux%20i686%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/31.0.1650.63%20Safari/537.36 - - 7 - tx20934ca545654f729d9b6af12b244f2a - 0.0002 -

Dec 12 22:59:29 cloud1 proxy 100.100.176.22 100.100.176.22 12/Dec/2013/17/29/29 GET / HTTP/1.0 404 - - - - 70 - tx5e04cadd1ba145adaffebafbb395fd1b - 0.0003 -
Dec 13 02:47:55 cloud1 proxy 121.56.217.206 121.56.217.206 12/Dec/2013/21/17/55 GET http%253A//www.baidu.com/robots.txt HTTP/1.0 404 - Mozilla/4.0%20%28compatible%3B%20Win32%3B%20WinHttp.WinHttpRequest.5%29 - - 70 - tx4a7e8abf3b2b43d29c208258ce8399c8 - 0.0003 -

Dec 13 03:25:57 cloud1 proxy 100.100.8.235 100.100.8.235 12/Dec/2013/21/55/57 HEAD / HTTP/1.0 404 - - - - - - tx9f28783556494fc6b58eeb6ae31d352a - 0.0004 -

Dec 13 05:13:43 cloud1 proxy 100.100.14.88 100.100.14.88 12/Dec/2013/23/43/43 GET http%253A//www.qq.com/ HTTP/1.0 404 - Mozilla/4.0%20%28compatible%3B%20MSIE%204.01%3B%20Windows%2098%29 - - 70 - txc564961a15184049812d0a5026f8c694 - 0.0003 -

Dec 13 07:07:16 cloud1 proxy 100.100.14.88 100.100.14.88 13/Dec/2013/01/37/16 GET http%253A//www.qq.com/ HTTP/1.0 404 - Mozilla/4.0%20%28compatible%3B%20MSIE%204.01%3B%20Windows%2098%29 - - 70 - tx835d0cff6cc04f5e9d1e9353a16ccc7b - 0.0003 -
Dec 13 08:29:53 cloud1 proxy SIGTERM received
Dec 13 08:29:53 cloud1 proxy Exited
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.