1

I am trying to log messages from a specific remote host to a separate log file (and only to that file). I tried this:

# cat /etc/rsyslog.d/avs110door.conf 

if $fromhost == 'avs110' then /var/log/avs110-door.log
& stop

The log file is not created, and the messages form that host are still sent to user.log, syslog, messages and auth.log (depending on the facility).

I did run systemctl restart rsyslog.service and other .conf files from that directory do work as expected.

This is a server with rsyslog version 8.4.2

The messages in the wrong files are like this (so the remote hostname is indeed 'avs110' as in my .conf file condition):

Jul 18 18:27:19 avs110 sshd[781]: Server listening on :: port 22.
Jul 18 18:27:39 avs110 engine[844]: Finished initialization
Jul 18 18:44:20 avs110 engine[844]: Calling sip:600@192.168.44.152:5060
Improve this question
5
  • There are two different reasons: First, as the rules in rsyslog.conf preceed the rules in rsyslog.d/, the default rules do match and so the entries are written to the facility logs. If you do not want that, youl'd have to write additional discard rules in your configuration file (see 'Discard' in the manpage of rsyslog.conf). Second, as far as I remember, syslog files are only written to if they already exist; so try sudo touch /var/log/avs110-door.log to see if will be filled up (maybe you have to change the owner to syslog:adm).
    – ridgy
    Jul 23, 2017 at 12:24
  • @ridgy I have a configuration similar to the above, without an additional Discard rule; all my rules are in a separate config file in /etc/rsyslog.d. Still, this rule works. Your second point is valid however; I need to touch the file for the rule to work.
    – Jos
    Jul 23, 2017 at 12:37
  • The [documentation]( rsyslog.com/…) suggests to define the remote rules before the local rules and to stop proceeding by defining & ~ (Discard). Maybe that helps.
    – ridgy
    Jul 23, 2017 at 12:55
  • @ridgy: I have $IncludeConfig /etc/rsyslog.d/*.conf before the default rules in /etc/rsyslog.conf, so that should be OK. Created the log file with touch now, and will see in a day or 2 if that was it. (I guess yes)
    – mivk
    Jul 24, 2017 at 12:16
  • 1
    Turns out that the value of $fromhost must be something other than the hostname written to the log. Replacing it with $fromhost-ip and the correct IP, it works.
    – mivk
    Jul 29, 2017 at 17:16

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.