Thanks for the reply Rainer. After sanitising my configuration in order to post it I realised my issue was one of my rulesets wasn't working due to having InputTCPServerBindRuleset after InputTCPServerRun.
Here is my simplified configuration for anyone else who finds this thread: $ModLoad imuxsock $ModLoad imklog $ModLoad imudp $ModLoad imtcp $ActionFileDefaultTemplate RSYSLOG_FileFormat $RuleSet local $FileOwner sshd *.* /var/log/test.log $DefaultRuleset local $template MyTemplate,"/var/syslog/%HOSTNAME%.log" $RuleSet from_remote_host $FileOwner ntp *.* ?MyTemplate $InputUDPServerBindRuleset from_remote_host $UDPServerRun 514 $InputTCPServerBindRuleset from_remote_host $InputTCPServerRun 514 My config works fine now. Thanks for your time, Max -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Rainer Gerhards Sent: 02 May 2014 09:32 To: rsyslog-users Subject: Re: [rsyslog] Different owner/group/mode on files from dyn template - Possible in 5.8? On Fri, May 2, 2014 at 10:16 AM, Max Williams <[email protected]> wrote: > Hi, > Is there a way to have specific owner/group/mode on dynamic files > generated from a template in rsyslog version 5.8? > I've tried setting FileOwner/FileGroup/FileCreateMode in various > places in the configuration but it doesn't seem to affect files from > templates. > You need to apply them in front of the action where you want them active. It would probably be good to post your rsyslog.conf. Rainer > Kind regards, > Max > > ____________________________ > > The London Metal Exchange is a company incorporated in England and > Wales with registered number 02128666, VAT registered number GB 918 > 4582 96 and having its registered office at 56 Leadenhall Street, London EC3A > 2DX. > > LME Clear Limited is a company incorporated in England and Wales with > registered number 07611628, VAT registered number GB 918 4582 96 and > having its registered office at 56 Leadenhall Street, London EC3A 2DX. > > The London Metal Exchange is a recognised investment exchange, > supervised by the Financial Conduct Authority (FCA). > > This email may have been sent on behalf of The London Metal Exchange, > LME Clear Limited, or jointly on behalf of both. > > Please note that this message is intended for the named recipient(s) only. > Its contents may be confidential or subject to professional privilege. > If you are not an intended recipient, you may not disclose, copy or > use in any way the information contained in it; please delete it and > notify [email protected] immediately and delete it from your system. > > Unless expressly attributed, the views expressed in this email do not > necessarily represent the views of the London Metal Exchange or LME > Clear Limited. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________ ____________________________ The London Metal Exchange is a company incorporated in England and Wales with registered number 02128666, VAT registered number GB 918 4582 96 and having its registered office at 56 Leadenhall Street, London EC3A 2DX. LME Clear Limited is a company incorporated in England and Wales with registered number 07611628, VAT registered number GB 918 4582 96 and having its registered office at 56 Leadenhall Street, London EC3A 2DX. The London Metal Exchange is a recognised investment exchange, supervised by the Financial Conduct Authority (FCA). This email may have been sent on behalf of The London Metal Exchange, LME Clear Limited, or jointly on behalf of both. Please note that this message is intended for the named recipient(s) only. Its contents may be confidential or subject to professional privilege. If you are not an intended recipient, you may not disclose, copy or use in any way the information contained in it; please delete it and notify [email protected] immediately and delete it from your system. Unless expressly attributed, the views expressed in this email do not necessarily represent the views of the London Metal Exchange or LME Clear Limited. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
