MonitorWare Knowledge Base

I am using rsyslog-1.21.1.

I have 2 Stations (laptop, router), which send the messages to the server named yaris.(running rsyslog).
On the server side it should generate '/var/log/yaris/syslog' '/var/log/laptop/syslog' and '/var/log/router/syslog'.

See my config

Code: Select all

$template Dynsys,"/var/log/%HOSTNAME%/syslog"
*.*;auth,authpriv,cron,mail,local0.none -?Dynsys


But written will be sometimes the right and sometimes the wrong as you can see below.
Sorry for my bad english (i am german ).

The output

Code: Select all

-1210219424: Called fprintlog, logging to builtin-file (Dynvdr)
-1210219424: Called fprintlog, logging to builtin-file (Dyndebug)
-1210219424: Removed entry 0 for file '/var/log/yaris/auth.log' from dynaCache.
-1210219424: Removed entry 1 for file '/var/log/laptop/auth.log' from dynaCache.
-1210219424: Removed entry 0 for file '/var/log/yaris/syslog' from dynaCache.
-1210219424: Removed entry 1 for file '/var/log/--/syslog' from dynaCache.
-1210219424: Removed entry 2 for file '/var/log/syslogd/syslog' from dynaCache.
-1210219424: Removed entry 0 for file '/var/log/yaris/cron.log' from dynaCache.
-1210219424: Removed entry 1 for file '/var/log/laptop/cron.log' from dynaCache.
-1210219424: Removed entry 0 for file '/var/log/--/kern.log' from dynaCache.
-1210219424: Removed entry 0 for file '/var/log/yaris/vdr/vdr.log' from dynaCache.
-1210219424: Removed entry 0 for file '/var/log/yaris/debug' from dynaCache.
-1210219424: Removed entry 0 for file '/var/log/yaris/messages' from dynaCache.
-1210219424: Removed entry 1 for file '/var/log/--/messages' from dynaCache.
-1210219424: Removed entry 2 for file '/var/log/syslogd/messages' from dynaCache.


Please help

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

HOSTNAME is parsed from the message. If the message is not formatted as described in RFC 3164, you'll have problems. And many use different formats. In this case, you can resort to FROMHOST, which is the last host in a relay chain, but it is consistent.

HTH
Rainer

Thanks for the very quick answer.

This means if I use an rsyslog client , then it is RFC3164 conform or is this dependant from the service who generate the message?

FROMHOST works, but it would be nice to generate a facility File per HOSTNAME.
So it would behave like a standard syslog client on Debian and others.

Code: Select all

$template Dynauth,"/var/log/%HOSTNAME%/auth.log"
auth,authpriv.* ?Dynauth       
$template Dynsys,"/var/log/%HOSTNAME%/syslog"
*.*;auth,authpriv,cron,mail,local0.none -?Dynsys
$template Dyncron,"/var/log/%HOSTNAME%/cron.log"
cron.* ?Dyncron
$template Dyndaemon,"/var/log/%HOSTNAME%/daemon.log"
daemon.* -?Dyndaemon
$template Dynkern,"/var/log/%HOSTNAME%/kern.log"
kern.* -?Dynkern
$template Dynlpr,"/var/log/%HOSTNAME%/lpr.log"
lpr.* -?Dynlpr
$template Dynmail,"/var/log/%HOSTNAME%/mail/mail.log"
mail.* -?Dynmail
$template Dynuser,"/var/log/%HOSTNAME%/user.log"
user.* -?Dynuser
$template Dynuucp,"/var/log/%HOSTNAME%/uucp.log"
uucp.* ?Dynuucp

$template Dynmailinfo,"/var/log/%HOSTNAME%/mail/mail.info"
mail.info -?Dynmailinfo
$template Dynmailwarn,"/var/log/%HOSTNAME%/mail/mail.warn"
mail.warn -?Dynmailwarn
$template Dynmailerr,"/var/log/%HOSTNAME%/mail/mail.err"
mail.err ?Dynmailerr


Maybe any better Idea?
Walter

With rsyslog on the client, it should work well.

Rainer

THX so far.

Walter

BTW. nice piece of software.