Unfortunately, the docs about the order of rules are unclear. The germane part is that the "localhost" keyword doesn't work on many systems,apparently, but the "fromhost-ip isequal "127.0.0.1" (the loopback address for the local host) does. Quirky.
In general, the config language has some very frustrating holes in it still, IMO. ljl > Thanks mate. I just cannot understand the rules in rsyslog clearly. Is > there any doc about the rules order or anything related? It looks like > the logical part is strange. > > Regards, > > Eric > > On Wed, Mar 2, 2011 at 10:59 AM, <[email protected]> wrote: >>> Hi, >>> >>> I have a question about separate logs order configuration. I have 4 >>> machines with hostnames server, storage, client1 and client2. The >>> rsyslogs is running at server. The configuration looks like that: >>> >>> $ModLoad imuxsock.so # provides support for local system logging (e.g. >>> via logger command) >>> $ModLoad imklog.so # provides kernel logging support (previously >>> done by >>> rklogd) >>> $ModLoad imtcp.so >>> $InputTCPServerRun 514 >>> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat >>> $template DynFile,"/var/log/system-%HOSTNAME%.log" >>> :source , !isequal , "localhost" ?DynFile >>> & ~ >> >> I have found that >> >> :source, condition, "localhost" action >> >> doesn't work. The "localhost" part is not functional, at least on my >> system. >> >> Try replacing the lines with >> >> :fromhost-ip, !isequal, "127.0.0.1" ?DynFile >> & ~ >> >> The fromhost-ip ... 127.0.0.1 works on CentOS 5 with rsyslog 5.6 >> >>> *.info;mail.none;authpriv.none;cron.none >>> /var/log/messages >>> authpriv.* /var/log/secure >>> mail.* >>> -/var/log/maillog >>> cron.* /var/log/cron >>> *.emerg * >>> uucp,news.crit >>> /var/log/spooler >>> local7.* >>> /var/log/boot.log >> >> ljl, new to the list >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
