MonitorWare Knowledge Base

Hi all,

I am sending (*.info;mail.none;authpriv.*;cron.none) to my remote rsyslog server @@10.0.0.4 and this is logging both the client and servers (*.info;mail.none;authpriv.*;cron.none) to /var/log/messages

Is there a way that I can log the local servers events (*.info;mail.none;authpriv.*;cron.none) to /var/log/messages (the way it works now) and any other external hosts logs to /logs/rsyslogs/allmessages.log?

is there a switch based on, say, everything except the local servers hostname?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

so do you want to log some messages ONLY to the remote hosts and others ONLY to the local host?

rgerhards wrote:so do you want to log some messages ONLY to the remote hosts and others ONLY to the local host?

no.

there are several hosts sending the same info to /var/log/messages locally & to an external server. Lets say 10.0.0.4.

So the line in each client config it would look like this...

Code: Select all

*.info;mail.none;authpriv.*;cron.none                   /var/log/messages
&                                                       @@10.0.0.4;SendWithoutTimestampTemplate


Now, there is one server (IP: 10.0.0.4) that is collecting these forwarded messages from the clients.
Upon collecting these messages it currently writes it to a single log. This is currently /var/log/messages locally on this server.

What I am trying to do is, on the server, keep /var/log/messages only for local server messages and have all the incoming client data for everything that is not the local server written to a separate log. Let's say /logs/rsyslog.log.

That is what I am trying to achieve.

I need to know the way to differentaite between data that has been accepted through TCP and data that has occured locally. Then route the data that has come in via TCP to /logs/rsyslog.log.

There's an example on the wiki that would answer your questions:

http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory

This may not fit your need exactly, but I do the following, where /var/log is actually a symlink to /opt/logs/system:

Code: Select all

$template messages,"/var/log/messages/%$YEAR%%$MONTH%%$DAY%/messages_%HOSTNAME%_%$YEAR%%$MONTH%%$DAY%.log"
*.info;mail.none;authpriv.none;cron.none                -?messages;TraditionalFormat

Every host has its own messages log file, including the centralized logging host.

Dan