[rsyslog] Create log files based on host name

[Rainer Gerhards]

Sorry, looks like I overlooked this message before. But Johnn has
provided a perfect answer :)

Rainer 

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com 
> [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Johnny Tan
> Sent: Tuesday, June 03, 2008 9:09 PM
> To: rsyslog-users; erik at tengblad.net
> Subject: Re: [rsyslog] Create log files based on host name
> 
> Erik Tengblad wrote:
> > Hello all,
> > 
> > First of all, let me apologize in advance for the somewhat 
> newbie-ish 
> > nature of this question. I'm sure there's an easy way to solve my 
> > problem, but I've been looking for an answer for weeks now 
> without being 
> > able to find one.
> 
> Seeing no one has yet replied, let me give this a shot (just 
> got back from vaca, else I would've replied earlier).
> 
> 
> > 1) All the log files are written per host. IE, we want 
> rsyslog to write 
> > seperate log files based on the host from which the logs 
> are being sent. 
> > Say we have 10 machines, each called host01 to host 10. We 
> want all the 
> > log information from host01 to be written to 
> /var/log/host01/logfile.log 
> > and so on. We've tried achieving this using templates and 
> the :hostname, 
> > isqueal, "host01" feature, but we just can't get it to 
> work. Most likely 
> > we've not used the correct syntax in the rsyslog.conf file.
> 
> $template HostMessages, "/var/log/%HOSTNAME%/logfile.log"
> 
> 
> 
> > 2) We want all log information containing a certain string 
> to be written 
> > to separate log files as well. So everything containing 
> 'zyx' should be 
> > written to /var/log/host01/zyx.log and everything containing 'abc' 
> > should be written to /var/log/host01/abc.log and so on.
> 
> I think you'd need two templates:
> $template HostAbcMessages, "/var/log/%HOSTNAME%/abc.log"
> $template HostZyxMessages, "/var/log/%HOSTNAME%/zyx.log"
> 
> :msg, contains, "abc"
> *.* ?HostAbcMessages
> 
> :msg, contains, "zyx"
> *.* ?HostZyxMessages
> 
> 
> johnn
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
>