Linux Destro is : Centos 6.8
Below is what the rsyslog.conf looks like:
# cat /etc/rsyslog.conf $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides kernel logging support (previously done by rklogd) #$ModLoad immark # provides --MARK-- message capability # Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $template server-dc, "/scratch/rsyslog/%HOSTNAME%/messages.log" authpriv.* ?server-dc *.info,mail.none,authpriv.none,cron.none ?server-dc $IncludeConfig /etc/rsyslog.d/*.conf #*.info;mail.none;authpriv.none;cron.none /var/log/messages #*.* @elk-rsyslog:514
Point for me to understand:
$template server-dc, "/scratch/rsyslog/%HOSTNAME%/messages.log" enter code here
So, in the above line
/scratch/rsyslog is a Directory path on the rsyslog server where we are forwarding all the logs from the unix remote hosts which crearts a directory structure following a message file like:
So, this works okay, However at the same time we have few network devices as well which are forwarding the network logs into the same location in a below format:
In the above case of network logs its creating a Directory by month name following a message file So, I'm looking for a way in rsyslog to define a different path for network logs as such
/scratch/rsyslog/network so the network logs can be collected into a Separate Folder, reason behind this is, i'm processing these logs to Elasticsearch hence i'm using wildcard for unix logs as
/scratch/rsyslog/*/messages.log but this also includes the network logs being wildcard(
So, Is there a way i can say if the logs are coming from particular remote host or IP should go to a particular Folder in rsyslog server?
2) Here in
$template server-dc, "/scratch/rsyslog/%HOSTNAME%/messages.log" what is login for putting server-dc as this is a another Hostname, Is this gets any purpose or we can change this to something relevant considering above requirement.
3) Same server-dc also been included into another config parameters as well.
Would simply like to know if there is way i can Forward the logs for like systems , network, firewall into the separate distinct Directories like..