0

I am having a problem with rsyslog that is duplicating the logs. I have configured rsyslog to receive logs from remote servers - Windows(installed a service that is converting events to syslog) and Linux. For this purpose I have added the following rows in rsyslog.conf as here:

######################
#### REMOTE RULES ####
######################


if $fromhost-ip == 'xx.xxx.xxx.xxx' then /var/log/RemoteSystems/remote1/remote1.log
&~
#
if $fromhost-ip == 'xx.xxx.xxx.xxy' then /var/log/RemoteSystems/remote2/remote2.log
&~
#
............

I would like to receive the logs only in these files - remote1.log and remote2.log, but some logs are also duplicated in auth.log, syslog, kern.log.

The other 2 conf files under rsyslog.d are default for Ubuntu.

slhck
  • 317
  • 2
  • 17
Ioan
  • 71
  • 1
  • 3

1 Answers1

0

From the rsyslog site:

if $fromhost-ip == '192.168.152.137' then {
        action(type="omfile" file="/var/log/remotefile02")
        stop
    }
slhck
  • 317
  • 2
  • 17
slass100
  • 111
  • 1