4

I am trying to configure rsyslog (Ubuntu 12.04 Server) to log events from a router. I found this old ubuntu forum post which got me most of the way there.

So far I am able to get the events logged from the router. However since I don't them logged in /var/log/syslog I am trying to set up a working filter in /etc/rsyslog.conf to put the logged events in /var/log/linksys.log. This is where I am having trouble.

  • First I tried filtering by the router ip address like this:

    :fromhost-ip, isequal, "192.168.2.1" /var/log/linksys.log
    & ~
    

    This successfully redirects the logs as I wanted, the only problem is now I am not getting any SSHD logs in auth.log. Needless to say this is not acceptable.

  • Next I tried filtering by the router name which appears in every event log:

    :msg,contains, "RV042" /var/log/linksys.log
    & ~
    

    Although this neither logs or blocks anything.

So I am stumped. I have no idea why SSHD is getting filtered with the :fromhost-ip filter. SSHD is local on the machine with rsyslog (192.168.2.2). I am thoroughly frustrated by this, any suggestions are much appreciated.

3

I figured it out! These links helped:

http://www.rsyslog.com/tag/udp/

http://www.rsyslog.com/doc/multi_ruleset.html

Here's what I did:

Opened up /etc/rsyslog.d/50-default.conf and at the top of the file, before other all of the default filters, I added:

# process remote messages
# define new ruleset and add rules to it:
$RuleSet remote
*.*           /var/log/linksys.log
# only messages not from 192.168.2.1 make it past this point

# bind ruleset to UDP listener
$InputUDPServerBindRuleset remote
# and activate it:
$UDPServerRun 514

# switch back to the default ruleset:
$RuleSet RSYSLOG_DefaultRuleset
1

/etc/rsyslog.conf is not the right file to be editing. You really want to be setting up a separate .conf file:

$ sudo nano /etc/rsyslog.d/20-router.conf

Then add the required configuration:

:fromhost-ip, isequal, "192.168.2.1" /var/log/linksys.log
& ~

This shouldn't confuse any other log entries. Just tried this myself and it works fine.

Thanks to http://nickhumphreyit.blogspot.co.uk/2012/09/how-to-setup-syslog-server-on-ubuntu.html for giving me the answer, after giving up on the documentation.

You may want to add a logrotate file to /etc/logrotate.d/linksys too:

/var/log/linksys.log {
       daily
       rotate 7
       delaycompress
       compress
       notifempty
       missingok
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.