Thanks for your answer. Yes I am sure that some lines do end up in other files like syslog and debug instead of the host file. Thanks,
Reinoud. On Thu, Apr 25, 2013 at 11:06 PM, David Lang <[email protected]> wrote: > On Thu, 25 Apr 2013, Reinoud Koornstra wrote: > > Hi Everyone, >> >> I've been trying to get everything from some host to a their hostfile. >> In the rsyslog.conf i have this: >> >> $template PerHostLog,"/var/log/remote-**hosts/%HOSTNAME%.log" >> if $fromhost-ip startswith '192.168.1.' then -?PerHostLog >> >> However, i still get messages from 192.168.1.75 for example in >> /var/log/syslog or in /var/log/debug instead of /var/log/remote-hosts/ >> 192.168.1.75 for example. >> Hence, log messages from 192.168.1.75 are scattered in several log file. >> I want all messages from that host to that specific file and the current >> template isn't cutting it obviously. >> The same holds for other hosts on that subnet. >> >> What am I doing wrong in my template? >> How to make everything from 192.168.1.75 goes to one file? >> Thanks, >> > > are you sure that the logs are going to the other files _instead_ of the > one file, not _in_addition_to_ the one file? > > Unless you take specific actions to prevent it, logs end up in all files > that have matching filters. > > David Lang > > Reinoud. >> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
