From 9926f878ab0e1a32ae167da47c9bd80105378ea1 Mon Sep 17 00:00:00 2001 From: Matthijs Kooijman Date: Thu, 10 Sep 2009 12:55:39 +0200 Subject: [PATCH] rsyslog: Put host-specific logs in separate dir. --- etc/rsyslog.conf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/etc/rsyslog.conf b/etc/rsyslog.conf index df51b37..54022c1 100644 --- a/etc/rsyslog.conf +++ b/etc/rsyslog.conf @@ -54,17 +54,17 @@ $IncludeConfig /etc/rsyslog.d/*.conf ######################## # Log lines received from other servers (as well as our own logs) centrally. -$template FacilityLog,"/data/log/rsyslog/%fromhost%/facilities/%syslogfacility-text%.log" -$template SeverityLog,"/data/log/rsyslog/%fromhost%/severities/%syslogseverity-text%.log" -$template AppLog,"/data/log/rsyslog/%fromhost%/apps/%app-name%.log" +$template HostFacilityLog,"/data/log/rsyslog/hosts/%fromhost%/facilities/%syslogfacility-text%.log" +$template HostSeverityLog,"/data/log/rsyslog/hosts/%fromhost%/severities/%syslogseverity-text%.log" +$template HostAppLog,"/data/log/rsyslog/hosts/%fromhost%/apps/%app-name%.log" # Use a verbose logging format $template LogFormat, "%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag% %syslogfacility-text%.%syslogseverity-text%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" # Log by facility, severity and appname -*.* ?FacilityLog;LogFormat -*.* ?SeverityLog;LogFormat -*.* ?AppLog;LogFormat +*.* ?HostFacilityLog;LogFormat +*.* ?HostSeverityLog;LogFormat +*.* ?HostAppLog;LogFormat # Log all entries in a single file, which is meant to be parsed by logcheck # (hence the traditional format). *.* -/data/log/rsyslog/all.log;RSYSLOG_TraditionalFileFormat -- 2.30.2