enricorossi.org

Enrico Rossi


Rsyslog with remote log and rotation by date

How to configure a debian (Wheezy) rsyslog daemon to receive logs from remote system, store them in a separate directory/file and the daily rotate these files with date-like extension.

What we want:

/var/log/
 ├── alternatives.log
 ├── alternatives.log.1
 .
 .
 .
 ├── remote
 │   ├── remote1_host_IP
 │   │   ├── remote1_host.log
 │   │   ├── remote1_host.log-20141202.gz
 │   │   ├── remote1_host.log-20141203.gz
 │   │   └── remote1_host.log-20141204
 │   ├── remote2_host_IP
 │   │   ├── remote2_host.log
 │   │   ├── remote2_host.log-20141202.gz
 │   │   ├── remote2_host.log-20141203.gz
 │   │   └── remote2_host.log-20141204
 │   └── remote3_host_IP
 │       ├── remote3_host.log
 │       ├── remote3_host.log-20141202.gz
 │       ├── remote3_host.log-20141203.gz
 │       └── remote3_host.log-20141204
 ├── syslog
 .
 .

First add the /etc/rsyslog.d/myremote.conf file as

#  /etc/rsyslog.conf Configuration file for rsyslog.

# The file name format to be used
$template DynFile,"/var/log/remote/%fromhost-ip%/%HOSTNAME%.log"

# define new ruleset and add rules to it
$RuleSet remote

# redirect everything to the file.
*.* -?DynFile

# switch back to the default ruleset:
$RuleSet RSYSLOG_DefaultRuleset

# Bind the remote messages to the ruleset remote.
# NOTE: the server must be started after the BindRuleset
$ModLoad imudp
$InputUDPServerBindRuleset remote
$UDPServerRun 514

and in the /etc/logrotate.d/rsyslog (keep 200 days) add these lines:

/var/log/remote/*/*.log
{
        rotate 200
        daily
        dateext
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

in the remote hosts just add somewhere in the /etc/rsyslog.conf file

*.* @mylogserver.mydomain

update Thu Dec 11 16:38:49 CET 2014:

Store the remote hosts directory as IP because same hostname but different FQDN will end in the same file (ex. host1.example.com and host1.subdomain.example.com will be both stored into the host1/host1.log file)