0

In a centralized logging facility, how do I prevent remote emergency messages from flooding users' consoles while still allowing the default

*.emerg    :omusrmsg:*

For any local emerg events?

In particular, I would like to log remote emerg messages to log files, and possibly send an email, but the remote machines shouldn't disrupt work on the master server.

The master server is RHEL 7.4 x86_64
rsyslog version: 8.24.0

server side configuration (snipped):
/etc/rsyslog.conf:

$ModLoad imuxsock
$ModLoad imjournal
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
*.emerg    :omusrmsg:*
$OmitLocalLogging on

/etc/rsyslog.d/listen.conf:

$systemLogSocketName /run/systemd/journal/syslog
0

Created a new /etc/rsyslog.d/remote-emerg.conf file:

$template myFormat0,"%timegenerated% %FROMHOST-IP% %syslogtag% %msg:::drop-last-lf\n"
if $fromhost-ip != '127.0.0.1' and $syslogseverity-text == 'emerg' then {
*.emerg /var/log/remote/PANIC;myFormat0
stop
}

Note: I tried using %HOSTNAME% instead of %FROMHOST-IP% but it alwayes printed localhost even when the remote hostname is configured correctly.

To test run both localy and on a remote host:

logger -p daemon.emerg "TEST from $HOSTNAME"

local run prints to cosole, remote is only logged to the file PANIC

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.