I can successfully have logs going to the correct files under
/var/log/remote/%HOSTNAME%/whatever, with the following template:
$template TmplAuthpriv, "/var/log/remote/%HOSTNAME%/secure"
$template TmplMsg, "/var/log/remote/%HOSTNAME%/messages"
$template TmplCron, "/var/log/remote/%HOSTNAME%/cron"
$template TmplMail, "/var/log/remote/smtp/%HOSTNAME%/maillog"
$template TmplCmd, "/var/log/remote/%HOSTNAME%/cmd"
and following ruleset:
$RuleSet justlogs
*.info;mail.none;authpriv.none;cron.none ?TmplMsg
$RuleSet RSYSLOG_DefaultRuleset
$InputTCPServerBindRuleset justlogs
$InputTCPServerRun 514
And direct some logs into specific folders, a la:
ruleset(name="remote1"){
if $msg contains 'VPX' then {
action(type="omfile"
file="/var/log/remote/netscaler/netscalerlog")
}
if $msg contains 'br01' then {
action(type="omfile"
file="/var/log/remote/cisco/router/routerlog")
}
if $msg contains 'appfw' then {
action(type="omfile"
file="/var/log/remote/netscaler/appfwlog")
}
}
$RuleSet RSYSLOG_DefaultRuleset #End the rule set by switching
back to the default rule set
$InputTCPServerBindRuleset remote1 #Define a new input and bind it
to the "remote1" rule set
$InputTCPServerRun 514
But not both at the same time! I've tried smashing the rulesets
together, but no joy.
Reading the manual makes my brain hurt. And the online rsyslog.conf
builder isn't working for me.
Pointers appreciated!
TIA
Pete
--
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
