rsyslog Filtering Based on IP Address with Wildcards

Question

I have some syslog traffic being processed by rsyslog and I'd like to set up filters to store the logs based on the IP addresses of the source devices. I have a large number of devices and would prefer to avoid creating a rule for each device. The IP scheme is consistent enough that I would think I could handle everything with a single rule but I'm having trouble getting it to work.

Here are a couple of (failed) examples of what I'm trying to accomplish:

:FROMHOST, regex, "10\.[0-9]+\.1\.2" -/var/log/test.log
& ~

or

if ( re_match($fromhost-ip, '10\.[0-9]+\.1\.2') ) then { -/var/log/test.log }
& ~ 

Basically, the IP scheme for these devices will always be 10.*.1.2, where * is a 2 digit number corresponding to the location of the device.

Can someone give me an idea of where I'm going wrong with this?

Thank you!

Answer 1

I was actually able to discover the solution on my own after finding a debug option for running rsyslog. Apparently, you can call rsyslogd directly from the console like so:

rsyslogd -d

Doing that will show a live stream of all rule parsing. After a ton of trial and error using this trick, I was able to determine that my filter rules were failing because several parts needed, not just escaped, but double escaped. This really surprised me.

Here is what my final rule looked like:

:fromhost-ip, regex, "10\\.[0-9]\\+\\.1\\.2" -/var/log/test.log
& ~

And here is the output for a couple of successful examples. Notice that the + has to show up here as escaped which is strange because no matches are found if you plug it into the official rsyslog regex tester this way:

Filter: check for property 'fromhost-ip' (value '10.1.1.2') regex '10\.[0-9]\+\.1\.2': TRUE

Filter: check for property 'fromhost-ip' (value '10.24.1.2') regex '10\.[0-9]\+\.1\.2': TRUE

In case anyone reading this some day is curious, here are some of my trial and error examples, most of which simply failed entirely:

Filter: check for property 'fromhost-ip' (value '10.1.1.2') regex '10.[0-9]+.1.2': FALSE

Filter: check for property 'fromhost-ip' (value '10.1.1.2') regex '^10.[0-9]+.1.2$': FALSE

Filter: check for property 'fromhost-ip' (value '10.1.1.2') regex '10\.[0-9]+\.1\.2': FALSE

Filter: check for property 'fromhost-ip' (value '10.1.1.2') regex '10\.1\.1\.2': TRUE

Filter: check for property 'fromhost-ip' (value '10.1.1.2') regex '10\.[0-9]\.1\.2': TRUE

Filter: check for property 'fromhost-ip' (value '10.1.1.2') regex '10\.[0-9]+\.1\.2': FALSE