I update o the version 8 of rsyslog and I have been able to do it using if $hostname == 'myhost' and $syslogfacility-text == 'local6' then file1.log
Thank you all. Cordialement, Pape DIOP. On Wed, Nov 19, 2014 at 8:00 PM, David Lang <[email protected]> wrote: > On Wed, 19 Nov 2014, Paps Diop wrote: > > The fact is i want to store the log by pool of server. Meaning that >> differents servers have the same log file and if I use dynacmic template i >> will have a log file for each server. >> > > With the Dynafile feature you can write the logs to any file that you can > progromatically define from the log message. > > You can trivially write to files named by hostname with a dynafile > template of "/var/log/perhost/%hostname%" > > But if you want to do something really sophisticated you may have to > create a dynafile template like "/var/log/per_pool/$.pool" and then have a > series of statements like > > if $fromhost-ip = ["1.1.1.1","1.1.1.2","1.1.1.3"] then set $.pool = > "file1"; > > to define the $.pool variable that will then be used in the dynafile > template. > > David Lang > > > > >> >> Cordialement, >> >> Pape DIOP. >> >> On Wed, Nov 19, 2014 at 6:05 PM, Rainer Gerhards < >> [email protected]> >> wrote: >> >> 2014-11-19 18:02 GMT+01:00 Paps Diop <[email protected]>: >>> >>> Using different port will forces me to create different vip but this >>>> solution should work. >>>> >>>> >>>> I thought a bit too complicated. If you want to store by the sender, >>> you >>> could also use the fromhost-ip address. This is always the sender the >>> directly sent to the receiver in question. So in a relay chain, it's not >>> the original sender but the last relay. >>> >>> HTH >>> Rainer >>> >>> >>> Regards, >>>> >>>> Pape. >>>> >>>> Cordialement, >>>> >>>> Pape DIOP. >>>> >>>> On Wed, Nov 19, 2014 at 5:53 PM, Rainer Gerhards < >>>> >>> [email protected] >>> >>>> >>>>> wrote: >>>> >>>> 2014-11-19 17:24 GMT+01:00 Paps Diop <[email protected]>: >>>>> >>>>> Hello, >>>>>> >>>>>> Thank you for your reactivity. >>>>>> >>>>>> I saw that but i did not explain well. The fact is i want that >>>>>> >>>>> rsyslog >>> >>>> server log in file1 message coming from server1, rsyslog server log >>>>>> >>>>> in >>> >>>> file1.log message coming from server2 and rsyslog server log in >>>>>> >>>>> file3.log >>>> >>>>> message coming from server3 and by using the dynamic template >>>>>> >>>>> %hostname% >>>> >>>>> or >>>>> >>>>>> %source% it is not possible. >>>>>> >>>>>> >>>>>> ah, ok. Is it possible to use different receiver ports for each of >>>>> the >>>>> clients? That would be the simples way to achive your desired result... >>>>> >>>>> Rainer >>>>> >>>>> >>>>> Regards, >>>>>> >>>>>> Pape. >>>>>> >>>>>> Cordialement, >>>>>> >>>>>> Pape DIOP. >>>>>> >>>>>> On Wed, Nov 19, 2014 at 5:06 PM, Rainer Gerhards < >>>>>> >>>>> [email protected] >>>>> >>>>>> >>>>>>> wrote: >>>>>> >>>>>> 2014-11-19 16:56 GMT+01:00 Paps Diop <[email protected]>: >>>>>>> >>>>>>> Hi, >>>>>>>> >>>>>>>> I wanted to know if it is possible to sort a my incoming rsyslog >>>>>>>> >>>>>>> by >>> >>>> source >>>>>>> >>>>>>>> in order to log in different ifle (rsyslog server log in file1 >>>>>>>> >>>>>>> message >>>>> >>>>>> coming from server1, rsyslog server log in file2.log message >>>>>>>> >>>>>>> coming >>> >>>> from >>>>>> >>>>>>> server2, etc...) >>>>>>>> >>>>>>>> >>>>>>>> This can be done with the dynafile feature. Please let me know if >>>>>>> >>>>>> this >>>> >>>>> links helps: >>>>>>> >>>>>>> http://www.rsyslog.com/article60/ >>>>>>> >>>>>>> If not, I'll see that I finally create some better documentation >>>>>>> >>>>>> tomorrow. >>>>>> >>>>>>> >>>>>>> Rainer >>>>>>> >>>>>>> Regards, >>>>>>>> >>>>>>>> Pape. >>>>>>>> _______________________________________________ >>>>>>>> rsyslog mailing list >>>>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>>>>> http://www.rsyslog.com/professional-services/ >>>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>>>> >>>>>>> myriad >>>>>> >>>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST >>>>>>>> >>>>>>> if >>> >>>> you >>>>> >>>>>> DON'T LIKE THAT. >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>> rsyslog mailing list >>>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>>>> http://www.rsyslog.com/professional-services/ >>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>>> >>>>>> myriad >>>>> >>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >>>>>>> >>>>>> you >>>> >>>>> DON'T LIKE THAT. >>>>>>> >>>>>>> _______________________________________________ >>>>>> rsyslog mailing list >>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>>> http://www.rsyslog.com/professional-services/ >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>> >>>>> myriad >>>> >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >>>>>> >>>>> you >>> >>>> DON'T LIKE THAT. >>>>>> >>>>>> _______________________________________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>> http://www.rsyslog.com/professional-services/ >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>> >>>> myriad >>> >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>> DON'T LIKE THAT. >>>>> >>>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>>> >>>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
