Thanks for your answer. Because of an earlier suggestion I took the effort to compile that latest rsyslog. As I was running an earlier ubuntu (10.04) i compiled it manually. It appeared i needed these libraries: libestr-0.1.5 libee-0.4.1 liblogging-0.7.1 liblognorm-0.3.6 librelp-1.0.5
Anyway's the result was there: rsyslogd 7.3.12 startup, module path '', bla bla. :) Now the regexes work nicely and all logging from the hosts come in their respective files. :) I used this configure statement: ./configure --enable-gssapi-krb5 --enable-rfc3195 --prefix=/usr --exec-prefix=/usr --program-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --program-transform-name=rsyslogd Also, i made a symlink: /usr/sbin/rsyslogd -> usrrsyslogd Because apparently the deamon is now called differently. Thanks, Reinoud. On Fri, Apr 26, 2013 at 1:06 PM, Josh Bitto <[email protected]> wrote: > I have a similar setup in my config that logs from different sources to > their own directory. > > The trick is at the beginning of your conditions that you're having your > sources from. Example: > > If > $source != 'some host name' > And > Another condition....etc.. > Then { ?yourtemplate > stop > } > > > I can't take credit for this because I had to have help as well.....but > this does work with wanting your own hosts go to their own directory even > though you have the same criteria for each host that you want to log....I > use severity and facility and programname as some conditions. > > > > > > > > > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Reinoud Koornstra > Sent: Friday, April 26, 2013 12:56 PM > To: rsyslog-users Subject: Re: [rsyslog] logging everything from a host to > a file > > Thanks for your answer. > Yes I am sure that some lines do end up in other files like syslog and > debug instead of the host file. > Thanks, > > Reinoud. > > > On Thu, Apr 25, 2013 at 11:06 PM, David Lang <[email protected]> wrote: > > > On Thu, 25 Apr 2013, Reinoud Koornstra wrote: > > > > Hi Everyone, > >> > >> I've been trying to get everything from some host to a their hostfile. > >> In the rsyslog.conf i have this: > >> > >> $template PerHostLog,"/var/log/remote-**hosts/%HOSTNAME%.log" > >> if $fromhost-ip startswith '192.168.1.' then -?PerHostLog > >> > >> However, i still get messages from 192.168.1.75 for example in > >> /var/log/syslog or in /var/log/debug instead of > >> /var/log/remote-hosts/ > >> 192.168.1.75 for example. > >> Hence, log messages from 192.168.1.75 are scattered in several log file. > >> I want all messages from that host to that specific file and the > >> current template isn't cutting it obviously. > >> The same holds for other hosts on that subnet. > >> > >> What am I doing wrong in my template? > >> How to make everything from 192.168.1.75 goes to one file? > >> Thanks, > >> > > > > are you sure that the logs are going to the other files _instead_ of > > the one file, not _in_addition_to_ the one file? > > > > Unless you take specific actions to prevent it, logs end up in all > > files that have matching filters. > > > > David Lang > > > > Reinoud. > >> ______________________________**_________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adis > >> con.net/mailman/listinfo/rsyslog> > >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.co > >> m/professional-services/> What's up with rsyslog? Follow > >> https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing > >> list, posts are ARCHIVED by a myriad of sites beyond our control. > >> PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > >> > >> ______________________________**_________________ > > rsyslog mailing list > > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adisc > > on.net/mailman/listinfo/rsyslog> > > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com > > /professional-services/> What's up with rsyslog? Follow > > https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing > > list, posts are ARCHIVED by a myriad of sites beyond our control. > > PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE > THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
