meta data for this page
Book Creator
 Add this page to your book
Book Creator
 Remove this page from your book  

 Manage book(0 page(s))
 Help

rsyslog

remote log server

do no log twice

Rsyslog - prevent local host logging twice 

module(load="imudp")
input(type="imudp" port="514" ruleset="remote")
ruleset(name="remote"){
 $template RemoteLogs,"/var/log/devices/%HOSTNAME%.log" 
 *.*  ?RemoteLogs
}

dump vars rule

$template DUMP_ALL_VAR,"/rsyslog/dump_hostname=%HOSTNAME%,fromhost=%FROMHOST%,fromhost-ip=%FROMHOST-IP%,syslogtag=%SYSLOGTAG%,programname=%PROGRAMNAME%,app-name=%APP-NAME%"
*.* ?DUMP_ALL_VAR
$template TPLinkSwitch,"/rsyslog/%FROMHOST%/syslog.log"
if ($msg contains "T2600G-28TS") then {
    ?TPLinkSwitch
    stop
}