Home / server / Questions / 766145
Accepted
BioRod
Asked: 2016-03-26 10:37:05 +0800 CST

remote rsyslog client/server issue

  • 772

I only want rsyslog to send the logs to the centralized rsyslog server but it is sending them locally as well. This is for legal reasons, the servers will not have a logs directory, only the centralized rsyslog server will have logs.

I thought by using '&~' in the client's rsyslog.conf, it will send logs remotely only but I am wrong.

Here is the centralized rsyslog server config:

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark   # provides --MARK-- message capability

module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$klogConsoleLogLevel 3

$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

*.info;*.!warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/messages

*.warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          -/var/log/spooler

$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.*   ?TmplAuth
*.info,mail.none,authpriv.none,cron.none   ?TmplMsg

Here is the client config:

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark   # provides --MARK-- message capability
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
*.info;*.!warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/messages &~
*.warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          -/var/log/spooler
if $syslogfacility-text == 'local6' and $programname == 'httpd' then   /var/log/httpd-access.log
if $syslogfacility-text == 'local6' and $programname == 'httpd' then ~
if $syslogfacility-text == 'local7' and $programname == 'httpd' then /var/log/httpd-error.log
if $syslogfacility-text == 'local7' and $programname == 'httpd' then ~
rsyslog

1 Answers

  1. Best Answer

    You probably have syntax problems. Try to write rules with newline separator like this:

    if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log &
~

    Or even better you can use modern RainerScript syntax instead of legacy format:

    if ( $syslogfacility-text == 'local6' and $programname == 'httpd' )
then {
    action(type="omfile" file="/var/log/httpd-access.log")
    stop
}

    It's more verbose and less ambiguous.

    • 1