I am trying to log messages from a specific remote host to a separate log file (and only to that file). I tried this:
# cat /etc/rsyslog.d/avs110door.conf if $fromhost == 'avs110' then /var/log/avs110-door.log & stop
The log file is not created, and the messages form that host are still sent to user.log, syslog, messages and auth.log (depending on the facility).
I did run
systemctl restart rsyslog.service and other .conf files from that directory do work as expected.
This is a server with rsyslog version 8.4.2
The messages in the wrong files are like this (so the remote hostname is indeed 'avs110' as in my .conf file condition):
Jul 18 18:27:19 avs110 sshd: Server listening on :: port 22. Jul 18 18:27:39 avs110 engine: Finished initialization Jul 18 18:44:20 avs110 engine: Calling sip:firstname.lastname@example.org:5060
rsyslog.confpreceed the rules in
rsyslog.d/, the default rules do match and so the entries are written to the facility logs. If you do not want that, youl'd have to write additional discard rules in your configuration file (see 'Discard' in the manpage of rsyslog.conf). Second, as far as I remember, syslog files are only written to if they already exist; so try
sudo touch /var/log/avs110-door.logto see if will be filled up (maybe you have to change the owner to syslog:adm).
Discardrule; all my rules are in a separate config file in
/etc/rsyslog.d. Still, this rule works. Your second point is valid however; I need to
touchthe file for the rule to work.
& ~(Discard). Maybe that helps.
$IncludeConfig /etc/rsyslog.d/*.confbefore the default rules in
/etc/rsyslog.conf, so that should be OK. Created the log file with
touchnow, and will see in a day or 2 if that was it. (I guess yes)
$fromhostmust be something other than the hostname written to the log. Replacing it with
$fromhost-ipand the correct IP, it works.