A tip for those who have a remote user server for their log files. When you set up a remote server you probably don’t want local messages to appear in the logging directory (directories) and here is how you can archive it:
Above all the rules in the configuration file “/etc/rsyslog.conf” (or where it is in your system) you include “if” statement for the local server like this:
# Remote logging $template HostIPtemp,"/mnt/logging/%FROMHOST-IP%.log" if ($fromhost-ip != "127.0.0.1" ) then ?HostIPtemp & stop
The name of the template is “HostIPtemp” and the starting part of the path “/mnt/logging/” may be anything you like.
All the remote messages will be redirected to the template and all the rules after won’t be applied to them because we use the “stop instruction”.
That’s why this rule must be above all rules in the whole rule configuration. Above all rules – probably you will find a commented line with “#### RULES ####”
The above configuration will have the following directory structure:
[root@srv ~]# ls -altr /mnt/logging/ total 2792 drwxr-xr-x. 7 root root 4096 12 Sep 10,05 .. drwxr-xr-x. 2 root root 4096 12 Sep 13,01 . -rw-------. 1 root root 2844525 12 Sep 13,01 10.10.10.10.log -rw-------. 1 root root 1245633 12 Sep 13,01 10.10.10.11.log -rw-------. 1 root root 9722578 12 Sep 13,01 10.10.10.12.log -rw-------. 1 root root 1127231 12 Sep 13,01 10.10.10.13.log