[rsyslog] Local Logging on Rsyslog Central Logserver

[david at lang.hm]

On Mon, 11 Jan 2010, Dirk H. Schulz wrote:

> Hi folks,
>
> I am running two central logservers using rsyslog that several dozen
> servers report to (mostly also rsyslog).
>
> The  central logservers are writing everything into a  database and
> additionally into local logfiles.
>
> I would like to change configuration in a way that only local messages
> are written to local logfiles, and all messages (local and received from
> remote servers) into the database.

yes, I do something similar to this on my systems.

All logs except local logs get written to local files, all local logs get 
sent over the network (at which point they then get picked up as remote 
logs), and all logs (local or remote) get sent to a remote system.

:fromhost, !isequal, "127.0.0.1"        /var/log/messages;TraditionalFormat
:fromhost, isequal, "127.0.0.1"         @192.168.1.8;TraditionalForwardFormat
*.*             @192.168.1.2