I have a similar setup in my config that logs from different sources to their
own directory.
The trick is at the beginning of your conditions that you're having your
sources from. Example:
If
$source != 'some host name'
And
Another condition....etc..
Then { ?yourtemplate
stop
}
I can't take credit for this because I had to have help as well.....but this
does work with wanting your own hosts go to their own directory even though you
have the same criteria for each host that you want to log....I use severity and
facility and programname as some conditions.
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Reinoud Koornstra
Sent: Friday, April 26, 2013 12:56 PM
To: rsyslog-users Subject: Re: [rsyslog] logging everything from a host to a
file
Thanks for your answer.
Yes I am sure that some lines do end up in other files like syslog and debug
instead of the host file.
Thanks,
Reinoud.
On Thu, Apr 25, 2013 at 11:06 PM, David Lang <[email protected]> wrote:
> On Thu, 25 Apr 2013, Reinoud Koornstra wrote:
>
> Hi Everyone,
>>
>> I've been trying to get everything from some host to a their hostfile.
>> In the rsyslog.conf i have this:
>>
>> $template PerHostLog,"/var/log/remote-**hosts/%HOSTNAME%.log"
>> if $fromhost-ip startswith '192.168.1.' then -?PerHostLog
>>
>> However, i still get messages from 192.168.1.75 for example in
>> /var/log/syslog or in /var/log/debug instead of
>> /var/log/remote-hosts/
>> 192.168.1.75 for example.
>> Hence, log messages from 192.168.1.75 are scattered in several log file.
>> I want all messages from that host to that specific file and the
>> current template isn't cutting it obviously.
>> The same holds for other hosts on that subnet.
>>
>> What am I doing wrong in my template?
>> How to make everything from 192.168.1.75 goes to one file?
>> Thanks,
>>
>
> are you sure that the logs are going to the other files _instead_ of
> the one file, not _in_addition_to_ the one file?
>
> Unless you take specific actions to prevent it, logs end up in all
> files that have matching filters.
>
> David Lang
>
> Reinoud.
>> ______________________________**_________________
>> rsyslog mailing list
>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adis
>> con.net/mailman/listinfo/rsyslog>
>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.co
>> m/professional-services/> What's up with rsyslog? Follow
>> https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing
>> list, posts are ARCHIVED by a myriad of sites beyond our control.
>> PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>>
>> ______________________________**_________________
> rsyslog mailing list
> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adisc
> on.net/mailman/listinfo/rsyslog>
> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com
> /professional-services/> What's up with rsyslog? Follow
> https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing
> list, posts are ARCHIVED by a myriad of sites beyond our control.
> PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
