hi, we use rsyslog 4.7.2 as central logserver and we logging in two files:
/var/log/remote/<remote_hostname>/messages and in /var/adm/messages and I don't want the second one for remote logging hosts (like info, notice etc.). Our config is: ========================== $ModLoad immark $ModLoad imuxsock $ModLoad imtcp.so $InputTCPServerRun 514 $ModLoad imudp.so $UDPServerRun 514 $InputTCPServerRun 10514 $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $template DynAuth, "/var/log/remote/%HOSTNAME%/secure.log" $template DynMSG, "/var/log/remote/%HOSTNAME%/messages" $template Dynmail, "/var/log/remote/%HOSTNAME%/maillog" $template Dyncron,"/var/log/remote/%HOSTNAME%/cron" $template Dynspool, "/var/log/remote/%HOSTNAME%/spooler" $template Dynboot, "/var/log/remote/%HOSTNAME%/boot.log" $template Dynlocal3, "/var/log/remote/%HOSTNAME%/local3.log" $template Dynlocal4, "/var/log/remote/%HOSTNAME%/local4.log" $template Dynlocal5, "/var/log/remote/%HOSTNAME%/local5.log" $template Dynlocal6, "/var/log/remote/%HOSTNAME%/local6.log" $template Dynlocal7, "/var/log/remote/%HOSTNAME%/local7.log" authpriv.* ?DynAuth *.info,mail.none,authpriv.none,cron.none ?DynMSG mail.* -?Dynmail cron.* ?Dyncron news.crit ?Dynspool local3.* ?Dynlocal3 local4.* ?Dynlocal4 local5.* ?Dynlocal5 local6.* ?Dynlocal6 local7.* ?Dynlocal7 *.emerg * *.alert root *.alert /dev/sysmsg auth.info /var/adm/authlog *.err /var/adm/syslog *.notice /var/adm/messages mail.debug @mail local0.info /var/adm/login local4.info /var/log/openldap/ldap.log daemon.debug /var/adm/messages daemon.info /var/adm/messages ============================== So how can I keep remote hosts away from my local logfiles and fill them up? cu denny _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
