Rsyslog filter by client

rsyslogsyslog

I set up an Rsyslog server that can receive messages from clients. The problem is that everything is concatenated to /var/log/syslog, so I'm trying to set up a filter server side.

I added this line at the end of /etc/rsyslog.conf:

if $fromhost-ip == '123.123.123.123' then /var/log/clientA.log

But it doesn't work at all (even if I replace == by != which is really weird). Of course I didn't forget to restart the service.

Any idea welcome.

Best Answer

Our config has some extra error checking in it preventing random hosts from generating logs.

# Templates                    
$template RemoteHost,"/data/log/remote/%HOSTNAME%/%$YEAR%/%$MONTH%-%$DAY%.log"
$template Garbage,"/data/log/remote/GARBAGE/%HOSTNAME%/%$YEAR%/%$MONTH%-%$DAY%.log"

# Discard SNMPD Connection Messages
if $programname == 'snmpd' and ( $msg contains 'Connection from UDP' or $msg contains 'Received SNMP packet(s) from UDP' ) then ~

# Archival Storage
#    All Messages, locally and remote stored to these rules
if $hostname contains '.mydomain.com' or $hostname contains '.myotherdomain.com' or $hostname contains '.local' then { 
  *.* ?RemoteHost 
} else { 
  *.* ?Garbage
}

# If not sourced locally, stop processing message.
:source , !isequal , "syslog1" ~
Related Topic