Mailing List Archive: How to separate remote and local logs?

How to separate remote and local logs?

Sep 11, 2020, 12:49 PM

Post #1 of 3 (461 views)

Dear all,

I have a Debian 9 machine and want to receive and store logs from an external hardware devices (SIP-ISDN gateways for instance). The gateway type supports remote logging via syslog.

I have checked and tried a number of tutorials, but none of them made my fully happy. What I want to achieve is:

Keep the local logging and files untouched
Write the remote logs in distinct directories
But, whatever I tried so far, I had remote logging messages also in /var/log/syslog or the local logs were written to /var/log/%THE_LOCAL_HOSTNAME%/ ...

So, apparently, my rsyslog configs so far did not correctly distinguish between local and remote.

Consider the following tutorial:
https://www.tecmint.com/install-rsyslog-centralized-logging-in-centos-ubuntu/

If I use that configuration, the problem is that the logs of the local machine are also written into a directory meant for the remote logs.

Any hints?

Regards,
Jens
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: How to separate remote and local logs? [ In reply to ]

rsyslog at lists

Sep 11, 2020, 1:00 PM

Post #2 of 3 (461 views)

Permalink

https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html

Use the modern syntax in the samples.

Rainer

Jens Bürger via rsyslog <rsyslog@lists.adiscon.com> schrieb am Fr., 11.
Sept. 2020, 21:49:

> Dear all,
>
> I have a Debian 9 machine and want to receive and store logs from an
> external hardware devices (SIP-ISDN gateways for instance). The gateway
> type supports remote logging via syslog.
>
> I have checked and tried a number of tutorials, but none of them made my
> fully happy. What I want to achieve is:
>
> Keep the local logging and files untouched
> Write the remote logs in distinct directories
> But, whatever I tried so far, I had remote logging messages also in
> /var/log/syslog or the local logs were written to
> /var/log/%THE_LOCAL_HOSTNAME%/ ...
>
> So, apparently, my rsyslog configs so far did not correctly distinguish
> between local and remote.
>
> Consider the following tutorial:
>
> https://www.tecmint.com/install-rsyslog-centralized-logging-in-centos-ubuntu/
>
> If I use that configuration, the problem is that the logs of the local
> machine are also written into a directory meant for the remote logs.
>
> Any hints?
>
> Regards,
> Jens
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: How to separate remote and local logs? [ In reply to ]

rsyslog at lists

Sep 25, 2020, 4:15 PM

Post #3 of 3 (458 views)

Permalink

[…]

> Am 11.09.2020 um 22:00 schrieb Rainer Gerhards <rgerhards@hq.adiscon.com>:
>
> https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html <https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html>
>
> Use the modern syntax in the samples.

Thanks! That did the trick!

I solved it as follows:

template (name="DynFile" type="string" string="/var/log/remote/system-%HOSTNAME%.log")
ruleset(name="remotelogs"){
action(type="omfile" dynaFile="DynFile")
}
...

input(type="imudp" port="514" ruleset="remotelogs")
input(type="imtcp" port="514" ruleset="remotelogs")

Jens
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.