I have configured centralized server for my all Linux servers. I can able to forward all system logs and Oracle database audit logs to centralized server. but my problem is all system and database logs are writing in one single file. My requirement is to write database logs to different file and system logs to different file in centralized location. Please find the scripts below.
192.168.1.150 : centralized server
192.168.1.44 : remote server
remote server configuration (192.168.1.44)
$ cat /etc/rsyslog.conf # Provides UDP syslog reception $ModLoad imudp.so $UDPServerRun 514 # Provides TCP syslog reception $ModLoad imtcp.so $InputTCPServerRun 514 *.info;mail.none;authpriv.none;cron.none /var/log/messages #Save oracle rdbms audit trail to oracle_audit.log local0.info /u01/app/oracle/admin/prod/adump/oracle_audit.log *.* @192.168.1.150:514
Centralized server configuration (192.168.1.150):
$ cat /etc/rsyslog.conf # Provides UDP syslog reception $ModLoad imudp.so $UDPServerRun 514 # Provides TCP syslog reception $ModLoad imtcp.so $InputTCPServerRun 514 $template RemoteHost,"/backup/CentralizeLogLocation/Linuxlogs/%HOSTNAME%/%HOSTNAME%-%$YEAR%%$MONTH%%$DAY%.log"
if ($hostname != '') then ?RemoteHost
The files are creating in this format for each host in centralised server thsc-vmmanager-20160614.log
Looks like everything is fine -- I got what I want, but both Oracle database audit logs and system logs are writing in one log file. I'm attaching the screenshot as well.
Now the requirement is to separate both the files. Please guide me as to how can I achieve this.