0

I wonder if you can help me to configure rsyslog to write logs from different subnets to different locations, ie:

Log everything coming from subnet 192.168.1 to dir. /log/subnet1, from subnet 192.168.2 to /log/subnet2.

Problem is that i have already plenty preconfigured templates - for each message type. Tried to adjust below example but without joy.

$template PerHostAuthSub1,"/log/subnet1/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/auth.log"
$template PerHostCronSub1,"/log/subnet1/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/cron.log"
$template PerHostSyslogSub1,"/log/subnet1/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/syslog"

$template PerHostAuthSub2,"/log/subnet2/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/auth.log"
$template PerHostCronSub2,"/log/subnet2/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/cron.log"
$template PerHostSyslogSub2,"/log/subnet2/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/syslog"
 
if ( $fromhost-ip startswith ‘192.168.1.‘ ) then  {
    ? PerHostAuthSub1
    ? PerHostCronSub1
    ? PerHostSyslogSub1
} else {
    ? PerHostAuthSub2
    ? PerHostCronSub2
    ? PerHostSyslogSub2
}

Second part of question is - to minimize code, can I replace log directories with variable and then set var in if condition? Idea is -

$template PerHostAuth,"/log/$variable/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/auth.log"
$template PerHostCron,"/log/$variable/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/cron.log"
$template PerHostSyslog,"/log/$variable/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/syslog"
 
if ( $fromhost-ip startswith ‘192.168.1.‘ ) then  {
    set variable = subnet1
} else {
    set variable = subnet2
}
  • Found solution in below post - https://superuser.com/questions/1002856/rsyslog-how-to-separate-incoming-logs-with-ip-addresses – MrBuzz73663 Oct 14 '22 at 09:16

0 Answers0