MonitorWare Knowledge Base

Hello all,

i installed rsyslog on my router (Ubuntu 8.10). It is the only machine which runs around the clock.
I have two other Linux machines, also with rsyslog. Now i want to use remote logging and have
the logfile separated by the sending host. I just want ot have separate dirs for the remote hosts,
not for the "central log server". I just used the example given here:
http://wiki.rsyslog.com/index.php/Sysklogd_drop-in_with_remote_logs_separated_by_dynamic_directory

In my /etc/rsyslog.conf is this statement to parse included files:
$IncludeConfig /etc/rsyslog.d/*.conf

i created a config file called remote-host.conf, with content:

Code: Select all

$template DYNcron,"/var/log/%HOSTNAME%/cron"

if \
        $fromhost-ip != '127.0.0.1' or $fromhost-ip !='192.168.1.254' \
                and \
        $syslogfacility-text == 'cron' \
then    ?DYNcron


The directory with the hostname of the logging server is created even i intend to not
create it via the != operator.

In the logfile i found:
Mar 30 15:54:05 xenia rsyslogd: [origin software="rsyslogd" swVersion="3.18.1" x-pid="13752" x-info=
Mar 30 15:54:05 xenia rsyslogd: invalid or yet-unknown config file command - have you forgotten to l
Mar 30 15:54:05 xenia rsyslogd: the last error occured in /etc/rsyslog.conf, line 22

After disabling the content of the included config file the error disappears. Installed version is 3.18.1-1.

What have i done wrong or what must i do to log in dynamic dirs just remote hosts and not the local host?

Best regards,
dragonfly

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

I suggest that you upgrade to a more recent build - as it looks, you use some feature that is not present in that version.

Thanks for the answer!

While i was absent for over a week, i just read it now. Which version do you recommend
to me?

Another Issue is, that some of the logs does not arrive on the central rsyslog server.
It is during the shutdown of one of my pc. It is used as a VDR. In it's shutdown-hooks
runs a script which logs some details to syslog. Due the forwarding setup it should appear
in the logs of the central log server. Sometimes it does, sometimes it does not.

You may have an idea where i can start to examine or create some debug file which
you can use for examination?

Best regards