Erik Tengblad wrote: > Hello all, > > First of all, let me apologize in advance for the somewhat newbie-ish > nature of this question. I'm sure there's an easy way to solve my > problem, but I've been looking for an answer for weeks now without being > able to find one.
Seeing no one has yet replied, let me give this a shot (just got back from vaca, else I would've replied earlier). > 1) All the log files are written per host. IE, we want rsyslog to write > seperate log files based on the host from which the logs are being sent. > Say we have 10 machines, each called host01 to host 10. We want all the > log information from host01 to be written to /var/log/host01/logfile.log > and so on. We've tried achieving this using templates and the :hostname, > isqueal, "host01" feature, but we just can't get it to work. Most likely > we've not used the correct syntax in the rsyslog.conf file. $template HostMessages, "/var/log/%HOSTNAME%/logfile.log" > 2) We want all log information containing a certain string to be written > to separate log files as well. So everything containing 'zyx' should be > written to /var/log/host01/zyx.log and everything containing 'abc' > should be written to /var/log/host01/abc.log and so on. I think you'd need two templates: $template HostAbcMessages, "/var/log/%HOSTNAME%/abc.log" $template HostZyxMessages, "/var/log/%HOSTNAME%/zyx.log" :msg, contains, "abc" *.* ?HostAbcMessages :msg, contains, "zyx" *.* ?HostZyxMessages johnn _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
