I use rsyslog to save logs from remote hosts to a server this way:


# Logfile for each host
$template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log"
*.* -?DynaFile


*.* @servername

This creates log files for every client host in servers /var/log/rsyslog/ but it logs every message also to the servers /var/log/syslog. So it gets really bloated. How can I prevent it so that /var/log/syslog only contains messages from the server itself?

  • 1
    You'll want to look into property based filters since HOSTNAME is one of the syslog fields. You'll basically want to change it so that it only selects its own logs for /var/log/syslog
    – Bratchley
    Feb 6, 2015 at 14:41

3 Answers 3


Here is what works for me:

## For accepting syslog info from remote hosts
$template TempAuth, "/var/log/infosys/%HOSTNAME%/%PROGRAMNAME%.log"
$template TempMsg,  "/var/log/infosys/%HOSTNAME%/%PROGRAMNAME%.log"

if ($fromhost-ip != "" ) then ?TempAuth
& ~
if ($fromhost-ip != "" ) then  ?TempMsg
& ~
  • 5
    Why is there a duplication between TempAuth and TempMsg?
    – vdboor
    Mar 17, 2020 at 10:02
  • Not working for me
    – lurker
    Jun 8, 2021 at 21:06

You have to make sure that your new rules are evaluated before the one that logs to /var/log/syslog.
For example on Ubuntu Trusty (rsyslog 7.4.4) /etc/rsyslog.conf contains
$IncludeConfig /etc/rsyslog.d/*.conf
so the default rules are loaded from /etc/rsyslog.d/50-default.conf, the one for /var/log/syslog included.

In this case you can add a new file to be loaded before that one, such as 00-remote.conf. For completeness, here's its content for a system I'm managing:

$template RemoteStore, "/var/log/remote/%HOSTNAME%/%timegenerated:1:10:date-rfc3339%"
& ~
  • This is the only thing that worked for me. I had to rename my configurations so that they are processed before 50-default.conf. For example, to ensure rules in /etc/rsyslog.d/53-firewall.conf don't end up in syslog, I simply renamed it to /etc/rsyslog.d/49-firewall.conf and restarted rsyslog.
    – Jim Walker
    Apr 17 at 5:58

I've been working on this a lot and i think i've found a solution. I encourage others to try this and look for potentially adverse consequences. I suggest that this be implemented on lab/testing and non critical machines first.

$template PerHostLog,"/var/log/net-hosts/%fromhost-ip%/%fromhost-ip%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %fromhost-ip% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n”
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
:fromhost-ip , !isequal , "" stop

The above 4 lines are in the top most section of my /etc/rsyslog.conf file

I'm currently watching 2 log files:
and /var/log/syslog

as I watch both, I'm seeing logs populate into the remote host file, yet not in the syslog. I restarted apache and saw log entries in syslog for this task.

  • Thanks for testing. But it doesn't work for me. It still logs everything to servers /var/log/syslog
    – Michael
    Mar 29, 2016 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.