2

I want the router and AP I have in my home network to use my Raspberry Pi running Debian as a syslog server (rsyslogd 5.8.11).However, I can't find anywhere a simple guide on how to receive logs from multiple devices easily and save them in different locations, there's just too much info about rsyslog but most is too complex stuff that I can't understand.

The router has IP 192.168.1.1 and the AP 192.168.1.5

Also, although I don't really need it,but feel curious about it, would it be possible to have the Pi send those logs to a VPS server automatically? The router has a dynamic IP address and uses a DDNS No-IP hostname.

3 Answers 3

1

The easiest way I've found to do this is to use a template that specified the hostname. For example, in /etc/rsyslog.conf:

$template TmplAuth, "/var/log/%HOSTNAME%/$year-$month-$day.log" 

See http://www.rsyslog.com/doc/v8-stable/configuration/properties.html for a list of all properties that you can use the template definition.

0

I did a small google search and I found the link that holds the following

# This one is the template to generate the log filename dynamically, depending on the client's IP address.

$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

# Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.

*.* ?FILENAME

2
  • The problem is that this will also log local events to /var/log/127.0.0.1/.Besides, it would create a different folder each time the external IP changes. Commented Dec 28, 2015 at 15:47
  • @user2859982 This was an example taken from the link, you can use hostname and divide the directories depending on time and log types if you want. All you have to do is man rsyslog.conf to get more information.
    – Digisec
    Commented Dec 28, 2015 at 16:20
0

I've got that successfully configured with this two lines in /etc/rsyslog.conf at the bottom:

$template DynaFile,"/var/log/system-%HOSTNAME%.log"
*.* -?DynaFile

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .