MonitorWare Knowledge Base

Hi.
I configured Rsyslogd to accept logs from the remote machines in my LAN:

Code: Select all

$ModLoad imudp
$UDPServerRun 514
$AllowedSender UDP, 192.168.33.0/24, *.eg.local


And to save all logs to MySQL:

Code: Select all

$ModLoad ommysql
*.* :ommysql:localhost,rsyslog,rsyslog,rsyslog_password


Now all logs (local and remote) are stored in files (for example /var/log/syslog) and in the MySQL database.

I only want the local logs to be stored in files, and all logs (local and remote) in the MySQL database.
How I can configure rsyslogd to have this?

Thank you very much!
Bye.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

The best thing is to do local messages first (via filters on hostname), then discard those messages. After that, do the remote machines. I think the forum search and/or the wiki ( http://wiki.rsyslog.com ) should bring up some sample configurations.

Rainer

rgerhards wrote:The best thing is to do local messages first (via filters on hostname), then discard those messages. After that, do the remote machines. I think the forum search and/or the wiki ( http://wiki.rsyslog.com ) should bring up some sample configurations.

Could you help me in doing this?
I read some articles in the documentation and in the wiki, but I didn't managed in understand how this works..

Hi,
For storing local logs in your /var/log/syslog you use filters involving from host so that you can turn those logs to seperate locations.

Regarding your database the statements you have used till now are sufficient.

Regards,
Prakash.