Rsyslog with remote log and rotation by date
How to configure a debian (Wheezy) rsyslog daemon to receive logs from remote system, store them in a separate directory/file and the daily rotate these files with date-like extension.
What we want:
/var/log/
├── alternatives.log
├── alternatives.log.1
.
.
.
├── remote
│ ├── remote1_host_IP
│ │ ├── remote1_host.log
│ │ ├── remote1_host.log-20141202.gz
│ │ ├── remote1_host.log-20141203.gz
│ │ └── remote1_host.log-20141204
│ ├── remote2_host_IP
│ │ ├── remote2_host.log
│ │ ├── remote2_host.log-20141202.gz
│ │ ├── remote2_host.log-20141203.gz
│ │ └── remote2_host.log-20141204
│ └── remote3_host_IP
│ ├── remote3_host.log
│ ├── remote3_host.log-20141202.gz
│ ├── remote3_host.log-20141203.gz
│ └── remote3_host.log-20141204
├── syslog
.
.
First add the /etc/rsyslog.d/myremote.conf file as
# /etc/rsyslog.conf Configuration file for rsyslog.
# The file name format to be used
$template DynFile,"/var/log/remote/%fromhost-ip%/%HOSTNAME%.log"
# define new ruleset and add rules to it
$RuleSet remote
# redirect everything to the file.
*.* -?DynFile
# switch back to the default ruleset:
$RuleSet RSYSLOG_DefaultRuleset
# Bind the remote messages to the ruleset remote.
# NOTE: the server must be started after the BindRuleset
$ModLoad imudp
$InputUDPServerBindRuleset remote
$UDPServerRun 514
and in the /etc/logrotate.d/rsyslog (keep 200 days) add these lines:
/var/log/remote/*/*.log
{
rotate 200
daily
dateext
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
in the remote hosts just add somewhere in the /etc/rsyslog.conf file
*.* @mylogserver.mydomain
update Thu Dec 11 16:38:49 CET 2014:
Store the remote hosts directory as IP because same hostname but different FQDN will end in the same file (ex. host1.example.com and host1.subdomain.example.com will be both stored into the host1/host1.log file)