I am trying to log messages from a specific remote host to a separate log file (and only to that file). I tried this:

# cat /etc/rsyslog.d/avs110door.conf 

if $fromhost == 'avs110' then /var/log/avs110-door.log
& stop

The log file is not created, and the messages form that host are still sent to user.log, syslog, messages and auth.log (depending on the facility).

I did run systemctl restart rsyslog.service and other .conf files from that directory do work as expected.

This is a server with rsyslog version 8.4.2

The messages in the wrong files are like this (so the remote hostname is indeed 'avs110' as in my .conf file condition):

Jul 18 18:27:19 avs110 sshd[781]: Server listening on :: port 22.
Jul 18 18:27:39 avs110 engine[844]: Finished initialization
Jul 18 18:44:20 avs110 engine[844]: Calling sip:600@
  • There are two different reasons: First, as the rules in rsyslog.conf preceed the rules in rsyslog.d/, the default rules do match and so the entries are written to the facility logs. If you do not want that, youl'd have to write additional discard rules in your configuration file (see 'Discard' in the manpage of rsyslog.conf). Second, as far as I remember, syslog files are only written to if they already exist; so try sudo touch /var/log/avs110-door.log to see if will be filled up (maybe you have to change the owner to syslog:adm). – ridgy Jul 23 '17 at 12:24
  • @ridgy I have a configuration similar to the above, without an additional Discard rule; all my rules are in a separate config file in /etc/rsyslog.d. Still, this rule works. Your second point is valid however; I need to touch the file for the rule to work. – Jos Jul 23 '17 at 12:37
  • The [documentation]( rsyslog.com/…) suggests to define the remote rules before the local rules and to stop proceeding by defining & ~ (Discard). Maybe that helps. – ridgy Jul 23 '17 at 12:55
  • @ridgy: I have $IncludeConfig /etc/rsyslog.d/*.conf before the default rules in /etc/rsyslog.conf, so that should be OK. Created the log file with touch now, and will see in a day or 2 if that was it. (I guess yes) – mivk Jul 24 '17 at 12:16
  • Turns out that the value of $fromhost must be something other than the hostname written to the log. Replacing it with $fromhost-ip and the correct IP, it works. – mivk Jul 29 '17 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.