1

I have a number of hosts sending logs to rsyslog server, and I'd like to distinguish them by adding their IP, i.e. /var/log/10.10.10.1-messages.log, /var/log/10.10.10.2-messages.log and so on. At the moment all messages land in the same log file.

Is it even possible to do so?

I know there exist syslog template files, is this what I should be looking at? I would appreciate some helpful examples, since documentation is quite confusing me.

Mark
  • 1,763
  • 5
  • 25
  • 45

1 Answers1

1

Yes, as you mentioned in your question, in rsyslog templates are the recommended way to generate dynamic file names. @meuh has already written a detailed answer to this, see rsyslog not writing dynamic log file.

Just replace the %hostname% message property with %fromhost-ip% in the template.

template(name="myDynFile" type="string"
    string="/var/log/%fromhost-ip%-messages.log")
eDonkey
  • 150
  • 8