Monday, April 13, 2020

rsyslog change output log file based on hostname

I want to put all the logs for hostnames starting with XXX in
/var/log/XXX.log.

And I'd also like to be able to read the file without having to do sudo
everytime...

Here is how:

in /etc/rsyslog.conf:

# remember to open your udp port to receive logs from other servers

$ModLoad imudp
$UDPServerRun 514
#### GLOBAL DIRECTIVES ####

# change umask so the default one doesn't mess with your filecreatemode permissions
$umask 0000

then create a file in /etc/rsyslog.d/50-my-XX-logs.conf:

#(any number is fine)

# this makes the file readable by anyone
$FileCreateMode 0644
:HOSTNAME, startswith, "XXX" /var/log/UHN2.log
# and stop any further filtering with the next line
& stop

This made it work for me. You can check more on the filters and
conditionals with rsyslog.conf(5) manual page.

No comments:

Post a Comment