I have configured rsyslog to log message to a centralised server it's working fine and I'm getting logs in my server's /var/log directory with seperate directory for all the clients based upon their ip addresses (ex: /var/log/ip-address/syslog.log) in it. It generates a file named syslog.log and logs are stored in it my question is can I configure rsyslog to generate all the traffic in different files like http in httpd.log mail in mail.log etc.

  • What was the question again? – Ignacio Vazquez-Abrams Jul 9 '13 at 6:11
  • I want that the logs of clients machine gets categorised like http traffic in http.log etc. right now everything is getting logged in a single file named syslog. So that is my question. – Tarun Jul 9 '13 at 6:19

In your configuration file, you have the template defined: $template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

When logging all facilities to that template, you are explicitly telling rsyslog to log everything to the file syslog.log. You need to set up seperate facility names for each application you want, ie. on, localhost, define http output as local7, and then on loghost, define a template like:

$template http,"/var/log/$fromhost-ip%/http.log"  
local7.* ?http

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.