0

I've enabled remote logging in my rsyslog.conf with:

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

and then in /etc/rsyslog.d/devices.conf, I have

$template RemoteLogs,"/var/log/devices/%HOSTNAME%.log" 
*.*  ?RemoteLogs

I'm finding though that the local machine (the rsyslog server) is logging its events not just to the relevant /var/log/filename but also /etc/log/devices/pi.log

How do i prevent the logs in /etc/log/devices/ for the local host (called pi) please?

Thanks

2 Answers 2

4

When specifying the input, also say which ruleset to apply. Input outside the ruleset will not be processed by the ruleset, and vice-versa.

module(load="imudp")
input(type="imudp" port="514" ruleset="remote")
ruleset(name="remote"){
 $template RemoteLogs,"/var/log/devices/%HOSTNAME%.log" 
 *.*  ?RemoteLogs
}
1
  • 1
    Great - many thanks. Works like a charm.
    – yeleek
    Commented Jan 29, 2021 at 17:06
0

the ruleset solution didn't work for me. all messages still show up in /var/log/messages. However this solution worked for me. basically, this line filtered out all messages come from a particular host.

:hostname, contains, "myhostname"  ~

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .