0249 | rsyslog log remote host to separate file

February 8th, 2021 by icez | Posted in Misc |

enter these in /etc/rsyslog.d/udp.conf

$ModLoad imudp
$UDPServerRun 514


$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$template RemoteHost,"/var/log/remote/%fromhost-ip%/%$YEAR%/%$MONTH%-%$DAY%.log"

if $fromhost-ip != '127.0.0.1' then ?RemoteHost
& stop