rsyslogd: Any way to get around the number of local facilities?

Question

We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?

Answer 1

Log the application name in your messages. Filter on the application name instead of facility. If your applications aren't generating syslog messages directly, you can apply an output filter (e.g., sed) to massage things to look the way you want.

Take a look at the Rsyslog documentation on filter conditions to see how you might configure this behavior. Based on the information in that page, here's an example of how you could put messages starting with the string "application1" into /var/log/application1:

if $msg startswith 'application1' then /var/log/application1

You can also filter explicitly on the program name, if your application sets this correctly:

if $programname == 'application1' then /var/log/application1

You can perform all sorts of complex filtering in your rsyslog.conf; read through the documentation for more information and examples.

EDIT: rsyslog can use templates to create separate files for each server. Something like the following should put all log messages into separate files for each hostname. (This is lifted from the manpage.)

$template DynFile,"/var/log/system-%HOSTNAME%.log
*.*                             ?DynFile

The following is similar but does not log debug messages. It also uses the connection hostname rather than the message hostname. (This is based on what I developed to log output from an Obi100.)

$template HostFormat,"%timegenerated% %fromhost% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$template HostFile,"/var/log/system-%fromhost%.log
if $syslogseverity < 7 then -HostFile;HostFormat

Read the manpage and documentation if you have more complex needs, or want to understand what the above do.

Answer 2

Filter by host name. (Each appliance should have its own hostname). If you want you can listen on multiple ports and handle each port separately.

Facilities are designed to handle message categories like authorization, mail, printer, ftp, etc. As UUCP isn't used much anymore you could likely use it for your own uses. Their may be other unused facilities in your configuration. However, you are better off using standard facilities values, and filtering by other data.

There are 24 facilities as they are names for bits in a bit mask. This makes aggregating arbitrary sets of facilities in the same log. The protocol is specified in RFC 5424.

The other field is severity. Normally logs contain all logs at or above a given severity. (More severe priorities have lower values, so the normal comparison is less than or equal to the selected priority.) However messages of a given facility can be selected, as is often done for the debug log which collects debug messages for all facilities.

You may want to aggregate data for some facilities in the same log regardless of originating appliance. It is common to log the same message to multiple log files.