I'm working on an rsyslog configuration and suddenly I'm no longer getting writes to /var/log/%HOSTNAME%/syslog
. It was working just fine but at some point I deleted the /var/log/%HOSTNAME%/syslog
file, and after that nothing was being written. The RemoteLogs
template I have in rsyslog.conf
is working, so maybe that's overwriting the syslog rule. If that was the case, I'd imagine auth.log
and kern.log
would also not be working, but they are. I tried removing that line but it didn't change anything.
Here is my server config:
## For more information see# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html## Default logging rules can be found in /etc/rsyslog.d/50-default.conf$template RemoteLogs,"/var/log/%HOSTNAME%/forwarded-logs.log"*.* -?RemoteLogs##################### MODULES #####################module(load="imuxsock") # provides support for local system logging#module(load="immark") # provides --MARK-- message capability# provides UDP syslog receptionmodule(load="imudp")input(type="imudp" port="514")# provides TCP syslog receptionmodule(load="imtcp")input(type="imtcp" port="514")# provides kernel logging support and enable non-kernel klog messagesmodule(load="imklog" permitnonkernelfacility="on")############################### GLOBAL DIRECTIVES ################################# Use traditional timestamp format.# To enable high precision timestamps, comment out the following line.#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat# Filter duplicated messages$RepeatedMsgReduction on## Set the default permissions for all log files.#$FileOwner syslog$FileGroup adm$FileCreateMode 0640$DirCreateMode 0755$Umask 0022$PrivDropToUser syslog$PrivDropToGroup syslog## Where to place spool and state files#$WorkDirectory /var/spool/rsyslog## Include all config files in /etc/rsyslog.d/#$IncludeConfig /etc/rsyslog.d/*.conf
My 50-default.conf with more granular rules:
$template AuthLog, "/var/log/%HOSTNAME%/auth.log"auth,authpriv.* -?AuthLog$template Syslog, "/var/log/%HOSTNAME%/syslog"*.*;auth,authpriv.none -?Syslog$template KernelLog, "/var/log/%HOSTNAME%/kern.log"kern.* -?KernelLog#lpr.* -/var/log/lpr.log$template MailLog, "/var/log/%HOSTNAME%/mail.log"mail.* -?MailLog
I'm sure there's a better way I can write that file, so any advice on that would be helpful (I'm brand new to rsyslog)