Cfrtjryk

I use rsyslog to save logs from remote hosts to a server this way:

Server:

# Logfile for each host

$template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log"

*.* -?DynaFile

Clients:

*.* @servername

This creates log files for every client host in servers /var/log/rsyslog/ but it logs every message also to the servers /var/log/syslog. So it gets really bloated. How can I prevent it so that /var/log/syslog only contains messages from the server itself?

I've been working on this a lot and i think i've found a solution. I encourage others to try this and look for potentially adverse consequences. I suggest that this be implemented on lab/testing and non critical machines first.

$template PerHostLog,"/var/log/net-hosts/%fromhost-ip%/%fromhost-ip%.log"

$template RemoteHostFileFormat,"%TIMESTAMP% %fromhost-ip% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%n”

:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat

:fromhost-ip , !isequal , "127.0.0.1" stop

The above 4 lines are in the top most section of my /etc/rsyslog.conf file

I'm currently watching 2 log files:


/var/log/net-hosts/10.1.1.1


and
/var/log/syslog



as I watch both, I'm seeing logs populate into the remote host file, yet not in the syslog. I restarted apache and saw log entries in syslog for this task.

Here is what works for me:

## For accepting syslog info from remote hosts

$template TempAuth, "/var/log/infosys/%HOSTNAME%/%PROGRAMNAME%.log"

$template TempMsg,  "/var/log/infosys/%HOSTNAME%/%PROGRAMNAME%.log"



if ($fromhost-ip != "127.0.0.1" ) then ?TempAuth

& ~

if ($fromhost-ip != "127.0.0.1" ) then  ?TempMsg

& ~

You have to make sure that your new rules are evaluated before the one that logs to /var/log/syslog.

For example on Ubuntu Trusty (rsyslog 7.4.4) /etc/rsyslog.conf contains
$IncludeConfig /etc/rsyslog.d/*.conf

so the default rules are loaded from /etc/rsyslog.d/50-default.conf, the one for /var/log/syslog included.

In this case you can add a new file to be loaded before that one, such as 00-remote.conf. For completeness, here's its content for a system I'm managing:

$template RemoteStore, "/var/log/remote/%HOSTNAME%/%timegenerated:1:10:date-rfc3339%"

:source,isequal,"NAS",-?RemoteStore

& ~