Thanks mate. I just cannot understand the rules in rsyslog clearly. Is there any doc about the rules order or anything related? It looks like the logical part is strange.
Regards, Eric On Wed, Mar 2, 2011 at 10:59 AM, <[email protected]> wrote: >> Hi, >> >> I have a question about separate logs order configuration. I have 4 >> machines with hostnames server, storage, client1 and client2. The >> rsyslogs is running at server. The configuration looks like that: >> >> $ModLoad imuxsock.so # provides support for local system logging (e.g. >> via logger command) >> $ModLoad imklog.so # provides kernel logging support (previously done by >> rklogd) >> $ModLoad imtcp.so >> $InputTCPServerRun 514 >> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat >> $template DynFile,"/var/log/system-%HOSTNAME%.log" >> :source , !isequal , "localhost" ?DynFile >> & ~ > > I have found that > > :source, condition, "localhost" action > > doesn't work. The "localhost" part is not functional, at least on my system. > > Try replacing the lines with > > :fromhost-ip, !isequal, "127.0.0.1" ?DynFile > & ~ > > The fromhost-ip ... 127.0.0.1 works on CentOS 5 with rsyslog 5.6 > >> *.info;mail.none;authpriv.none;cron.none /var/log/messages >> authpriv.* /var/log/secure >> mail.* -/var/log/maillog >> cron.* /var/log/cron >> *.emerg * >> uucp,news.crit /var/log/spooler >> local7.* /var/log/boot.log > > ljl, new to the list > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
