Linux rsyslog modification

Question

I have configured rsyslog and set following value:

$template serverlog, "/var/log/TEST/%HOSTNAME%/server.log"
local4.* ?serverlog

Now the code will create folder based on %HOSTNAME%, but I would like to create folder First on server name (company name) and then HOSTNAME.

For example: I have 3 servers for the 2 different companies ABCD and xyz, and their 3 server names (hostname) is: abcdapp-1t abcdapp-2t abcdapp-3t

xyzapp-1t xyzapp-2t xyzapp-3t

Now if I run the above template, it will create different folders according to hostname under /var/log/TEST/ , but I need to create 2 different folders ABCD and XYZ and relative hostname will go under specific directory and create subfolder.

For example: required to looks like this:

/var/log/TEST/ABCD/abcdapp-1t/server.log
/var/log/TEST/ABCD/abcdapp-2t/server.log
/var/log/TEST/ABCD/abcdapp-3t/server.log

/var/log/TEST/XYZ/xyzapp-1t/server.log
/var/log/TEST/XYZ/xyzapp-2t/server.log
/var/log/TEST/XYZ/xyzapp-3t/server.log

As I have more than 15 different servers of clients, I can not do it in one statement.

How can I use If else IF statements in rsyslog , so I can filter by HOSTNAME and move to specific folder?

Is there any suggestion?

Answer 1

If we assume your HOSTNAME field is of the form alphabetic-restofname and the initial alphabetic part is your company name, you can separate it from the field using the regexp property replacer. Change your template to

$template serverlog, "/var/log/TEST/%hostname:R,ERE,1,FIELD:([^-]+)--end%/%HOSTNAME%/server.log"

The regexp pattern is ([^-]+), meaning one or more characters not including -. The rest specifies that only the first capturing group ,1 of the ,ERE extended regexp syntax should be kept. If there is no match the whole FIELD is kept.

You must have rsyslog version 3.19.5 or later, or 4.1.5 or later. See the above link for changing to uppercase if wanted.

---

Alternatively, you should be able to do what you want, if your rsyslog is version 7 or later, using RainerScript as follows:

$template myplate,"/var/log/TEST/%$.customer%/%hostname%/server.log"
if ($hostname startswith "abcd") then set $.customer = "ABCD";
if ($hostname startswith "xyz") then set $.customer = "XYZ";
action(type="omfile" dynaFile="myplate")
stop

This creates a template using a local variable $.customer. The variable is set for each message when the hostname is matched by each if statement. The action writes the message to the calculated file. You can add another if statement for each customer.