rSyslog – How to Categorize Logs by Port with rSyslog

rsyslog

I've always used Syslog-NG for my logging situations, but my hands are tied and I have to use rsyslog, something I'm not overly familiar with.

I largely understand how to configure it, however, one of the ways I want to do it is to categorise by device type, ie, Linux device logs go into a linux folder, same for windows etc etc.

With Syslog-NG, I was able to do this by having a different port for each device type, and then having Syslog-ng place it in the correct folder by the port.

I can't find a way of doing this is in rsyslog. I've tried templates, but all that's doing is putting everything in the linux folder and everything in the windows folder, essentially duplicating. I've tried with filters, but getting nowhere with that either.

Firstly, does anyone know if its possible to categorise logs this way? And if so, could you point me in the right direction?

Best Answer

If you want to input from a given tcp port to go to one logfile, and from a second tcp port to go to another, check out Multiple Rulesets. The example Split local and remote logging for three different ports cut down to 2 tcp ports 10514 and 10515 gives you:

ruleset(name="remote10514"){
    action(type="omfile" file="/var/log/fileA")
}
ruleset(name="remote10515"){
    action(type="omfile" file="/var/log/fileB")
}
input(type="imptcp" port="10514" ruleset="remote10514")
input(type="imptcp" port="10515" ruleset="remote10515")

Inside each ruleset(){...} you can have any usual further filtering and templating.

Related Topic