Re: Obscure rsyslog question on remote logging

[Chris Adams]

Once upon a time, Tom Horsley  said:
> I found some obscure text about needing to use a $ in front of
> system variables and since $myhostname is a system variable
> I need to type it as $$myhostname in the condition (I think :-)

So an alternate approach that might help... you can assign a ruleset to
an input, and the UDP input is separate from the local input.  I put
this in /etc/rsyslog.d/net.conf:

########################################################################
template(name="Remote" type="list") {
        constant(value="/var/log/remote/")
        property(name="hostname")
        constant(value=".log")
}

module(load="imudp")

$umask 0022
ruleset(name="remote") {
        *.*     action(type="omfile" DynaFile="Remote" fileCreateMode="0644")
}
input(type="imudp" port="514" ruleset="remote")
########################################################################

My template is a simple /var/log/remote/<hostname>.log (I use the really
redundant .log extension so I can have a logrotate config to get
/var/log/remote/*.log).  I set the umask to 0022 and the file create
mode to 0644 because I have the group permissions on the /var/log/remote
directory to allow certain non-root users to read these logs.