Home / server / Questions / 837010
In Process
Ioan
Asked: 2017-03-09 06:10:40 +0800 CST

Rsyslog logs are beeing duplicated

  • 772

I am having a problem with rsyslog that is duplicating the logs. I have configured rsyslog to receive logs from remote servers - Windows(installed a service that is converting events to syslog) and Linux. For this purpose I have added the following rows in rsyslog.conf as here:

######################
#### REMOTE RULES ####
######################


if $fromhost-ip == 'xx.xxx.xxx.xxx' then /var/log/RemoteSystems/remote1/remote1.log
&~
#
if $fromhost-ip == 'xx.xxx.xxx.xxy' then /var/log/RemoteSystems/remote2/remote2.log
&~
#
............

I would like to receive the logs only in these files - remote1.log and remote2.log, but some logs are also duplicated in auth.log, syslog, kern.log.

The other 2 conf files under rsyslog.d are default for Ubuntu.

linux ubuntu log-files rsyslog logserver

1 Answers

  1. From the rsyslog site:

    if $fromhost-ip == '192.168.152.137' then {
        action(type="omfile" file="/var/log/remotefile02")
        stop
    }
    • 0