-1

I'm actually working on Syslog Server in CentOS 7. I would like to create a dynamic file from the user variable on the message part.

So, in my example, if the message part is :

30-Jan-2022 11:50:10 HOSTNAME ... pri=5 confid=01 slotlevel=2 user="A.Smith" domain="lab.test" ...

I want to dynamically create a file (named A.Smith) and put all logs from the user A.Smith in here. And do this for all the others : 400 users.

My rsyslog.conf is currently configured like this :

 $template ChangeFormatLog,"%$day%-%timegenerated:1:3:date-rfc3164%-%$year% %timegenerated:12:19:date-rfc3339% %HOSTNAME% %syslogtag% %msg%\n"
 
 $templateDynamicFile,"/var/log/syslogclients/$YEAR-$MONTH-$DAY/%HOSTNAME%.log"
 
 *.* ?DynamicFile;ChangeFormatLog

I don't know what to write in the rsyslog.conf to retrieve this data .. or if it's possible (?)

Someone can help me plz ?

vinalti
  • 966
  • 5
  • 26
Aurélien BOURDOIS
  • 3
  • 2
  • For clarification: You have X host machines with X users and you want to create X `someUser.log` files for the users on each host machine. Then you want to send each log file to your syslog server. Is that correct? – eDonkey Jan 31 '22 at 08:17

2 Answers2

0

What you're trying to achieve is not possible just using rsyslog. This answer is based on the assumption, that you have multiple users on multiple host machines.

  1. Create a script which creates a username.log files for each user.

  2. Create a script which writes all needed data to username.log file

  3. Forward all the username.log files to your syslog server

eDonkey
  • 606
  • 2
  • 7
  • 25
0

The problem is that i have arround 20 computers for arround 400 users.

It’s internet station for clients. They can put their ID on a captive portal into Firefox. They share the same account windows.

I just want to create user.log (user = ID put into the captive portal), in my server syslog.

Actually i retrieve my logs like that :

30-Jan-2022 11:50:10 HOSTNAME ... pri=5 confid=01 slotlevel=2 user="A.Smith" domain="lab.test" ..

I guess it’s possible with a script who analyzes the frames .. Dunno how to do this

Aurélien BOURDOIS
  • 3
  • 2
  • Please append this "answer" to your question. That way its easier to read for others. Also, please check out [How do I ask a good question?](https://stackoverflow.com/help/how-to-ask) – eDonkey Feb 01 '22 at 08:12