Create separated syslog file for each host with rsyslog
31,301
It seems it is documented on rsyslog web site here : https://www.rsyslog.com/storing-and-forwarding-remote-messages
To summarize :
You should define a template for log files, something like e.g :
# log every host in its own directory
$template RemoteHost,"/var/syslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog.log"
Then apply this template to messages coming from remote hosts :
# Remote Logging
$RuleSet remote
*.* ?RemoteHost
Author by
eden881
Updated on September 18, 2022Comments
-
eden881 over 1 year
I have a syslog server (running rsyslog on RHEL 7.4) that consolidates all the syslogs from my network devices. It's listening on port TCP/514.
I want to redirect the logs of each device to a different file in a dedicated directory (based on their IP address), instead of getting them all in
/var/log/messages
. How can I do that?