I use rsyslog to save logs from remote hosts to a server this way:


# Logfile for each host
$template DynaFile,"/var/log/rsyslog/%HOSTNAME%.log"
*.* -?DynaFile


*.* @servername

This creates log files for every client host in servers /var/log/rsyslog/ but it logs every message also to the servers /var/log/syslog. So it gets really bloated. How can I prevent it so that /var/log/syslog only contains messages from the server itself?

  • 1
    You'll want to look into property based filters since HOSTNAME is one of the syslog fields. You'll basically want to change it so that it only selects its own logs for /var/log/syslog – Bratchley Feb 6 '15 at 14:41

Here is what works for me:

## For accepting syslog info from remote hosts
$template TempAuth, "/var/log/infosys/%HOSTNAME%/%PROGRAMNAME%.log"
$template TempMsg,  "/var/log/infosys/%HOSTNAME%/%PROGRAMNAME%.log"

if ($fromhost-ip != "" ) then ?TempAuth
& ~
if ($fromhost-ip != "" ) then  ?TempMsg
& ~
  • 3
    Why is there a duplication between TempAuth and TempMsg? – vdboor Mar 17 '20 at 10:02

I've been working on this a lot and i think i've found a solution. I encourage others to try this and look for potentially adverse consequences. I suggest that this be implemented on lab/testing and non critical machines first.

$template PerHostLog,"/var/log/net-hosts/%fromhost-ip%/%fromhost-ip%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %fromhost-ip% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n”
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
:fromhost-ip , !isequal , "" stop

The above 4 lines are in the top most section of my /etc/rsyslog.conf file

I'm currently watching 2 log files:
and /var/log/syslog

as I watch both, I'm seeing logs populate into the remote host file, yet not in the syslog. I restarted apache and saw log entries in syslog for this task.

  • Thanks for testing. But it doesn't work for me. It still logs everything to servers /var/log/syslog – Michael Mar 29 '16 at 8:41

You have to make sure that your new rules are evaluated before the one that logs to /var/log/syslog.
For example on Ubuntu Trusty (rsyslog 7.4.4) /etc/rsyslog.conf contains
$IncludeConfig /etc/rsyslog.d/*.conf
so the default rules are loaded from /etc/rsyslog.d/50-default.conf, the one for /var/log/syslog included.

In this case you can add a new file to be loaded before that one, such as 00-remote.conf. For completeness, here's its content for a system I'm managing:

$template RemoteStore, "/var/log/remote/%HOSTNAME%/%timegenerated:1:10:date-rfc3339%"
& ~

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.