[rsyslog] Create log files based on host name

[Johnny Tan]

Erik Tengblad wrote:
> Hello all,
> 
> First of all, let me apologize in advance for the somewhat newbie-ish 
> nature of this question. I'm sure there's an easy way to solve my 
> problem, but I've been looking for an answer for weeks now without being 
> able to find one.

Seeing no one has yet replied, let me give this a shot (just 
got back from vaca, else I would've replied earlier).


> 1) All the log files are written per host. IE, we want rsyslog to write 
> seperate log files based on the host from which the logs are being sent. 
> Say we have 10 machines, each called host01 to host 10. We want all the 
> log information from host01 to be written to /var/log/host01/logfile.log 
> and so on. We've tried achieving this using templates and the :hostname, 
> isqueal, "host01" feature, but we just can't get it to work. Most likely 
> we've not used the correct syntax in the rsyslog.conf file.

$template HostMessages, "/var/log/%HOSTNAME%/logfile.log"



> 2) We want all log information containing a certain string to be written 
> to separate log files as well. So everything containing 'zyx' should be 
> written to /var/log/host01/zyx.log and everything containing 'abc' 
> should be written to /var/log/host01/abc.log and so on.

I think you'd need two templates:
$template HostAbcMessages, "/var/log/%HOSTNAME%/abc.log"
$template HostZyxMessages, "/var/log/%HOSTNAME%/zyx.log"

:msg, contains, "abc"
*.* ?HostAbcMessages

:msg, contains, "zyx"
*.* ?HostZyxMessages


johnn