|
Logging remote host to specific logfile with syslog-ng on Ubuntu |
|
|
|
To log to a specific log file based on it's host/ip you need to use syslog-ng as the regular syslog daemon do not allow this. You can easily install syslog-ng which is a pre-configured replacement for syslog/klog.
# apt-get install syslog-ng
Now we need to modify the configuration, edit /etc/syslog-ng/syslog-ng.conf, and first we need to add udp listening to accept remote syslogs. We could do this under the s_all source, but we need to define a different source so our remote hosts logs do not get mixed in with our regular ones. Place this after source s_all is finished. source s_net { udp (); };
Now further down where logging starts, we need to first add a filter for our openwrt host and we will use its ip to do this. Then we add a log file destination for that specific host. And after that we put in the log definition with our newly created source, our host filter, and our file destination. filter f_openwrt { host( "192.168.1.1" ); }; destination df_openwrt { file("/var/log/openwrt.log"); }; log { source ( s_net ); filter( f_openwrt ); destination ( df_openwrt ); };
Go ahead and restart syslog-ng now: # /etc/init.d/syslog-ng restart
Since we added a new logfile, we need to modify /etc/logrotate.d/syslog-ng. This will make sure our new logfile gets rolled. This entry has to go in before the last one which restarts the syslog-ng daemon. Here's what I put in: /var/log/openwrt.log { rotate 7 weekly missingok notifempty compress }
|