I've setup an rsyslog server which accepts log information from clients.
I can successfully receive syslog messages however I'm interested in logging a number of files too.
Here is what my client looks like:
$ModLoad imfile
$InputFileName /var/log/drew-error.log
$InputFileTag drew:
$InputFileStateFile stat-drew-error
$InputFileSeverity error
$InputRunFileMonitor
$InputFilePollInterval 1
I'm not sure exactly what to put in my server config. Ideally I'd like the server to output something like this:
/var/log/remote/$HOSTNAME/drew-error.log
Am I going about this the right way? Is this reasonable to try to achieve?
Best Case Scenario: I'd like to be able to update the files I'm watching on the client, without having to reconfigure the server. If that's not possible, or too hard, I can probably work around a hard-coded solution.
What I've tried
So far I've tried a few configurations for the server (though I feel they're not the right solution/approach):
$template syslog, "/var/log/remote/%hostname%/%programname%/%$year%%$month%%$day%/syslog"
*.*;auth,authpriv.none ?syslog
and
$template DrewTemplate,"/var/log/remote-DREWAPP-%HOSTNAME%.log"
if $programname == 'drew:' then -?DrewTemplate
& ~
$template PerHostLog,"/var/log/remote-%HOSTNAME%.log"
if $fromhost-ip startswith '1.2.' then -?PerHostLog
& ~