1

I am trying to get remote devices to into separate log files and not in the main syslog file.

I have created a filter for remote devices to go to a separate file per host, but still remote devices log contents end up in main syslog. I've tried both & ~ and & stop.

Common problem but can't find a working answer. rsyslog 5.8.6 (Ubuntu 12 LTS)

/etc/rsyslog.d/20-external.conf:

$template PerHostLog,"/var/log/external/%HOSTNAME%.log"
if $fromhost-ip != '127.0.0.1' then -?PerHostLog
#& ~
& stop

All other files are the same, except for changes to /etc/rsyslog.conf to enable remote logging.

My files per host do have contents, but they are also still coming into the main syslog file.

Whats the best way to adjust either configuration or filter to make sure they stay in the separate files, and not in the syslog file.

Any ideas what I'm doing wrong?

  • I don't suppose you've tried &~ (no space) rather than & ~? – Ken Sharp Dec 17 '15 at 13:20
0

Put both conditions on separate lines:
if $fromhost-ip != '127.0.0.1' then -?PerHostLog
if $fromhost-ip != '127.0.0.1' then stop

0

If your filters working you could edit your /etc/rsyslog.conf to stop duplicates as per this thread:

https://serverfault.com/questions/711708/stop-crontab-from-filling-syslog-ubuntu-15-04/717244#717244

  • This is on the right track expect I don't know which facility external syslog messages come under. – TimL Sep 24 '15 at 2:13
  • This link shows you a list of syslog facilities as well as a method of monitoring the actual messages on your system to see what codes are in use fir3net.com/UNIX/Linux/… – Ek0n0m1k Nov 12 '15 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.