Untitled

/etc/rsyslog.d/00-remote-collector.conf

# provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

$AllowedSender UDP, ...

 

# provides TCP syslog reception

$ModLoad imtcp

$InputTCPMaxSessions 2048

$InputTCPServerRun 601

$AllowedSender TCP, ...

 

$template DailyPerHostLogs,"/var/log/remote/hosts/%fromhost:R,ERE,1,FIELD:^([^\.]*)\.x\.y\.z$--end:secpath-replace%/%syslogfacility-text%.log-%$YEAR%%$MONTH%%$DAY%"

*.* -?DailyPerHostLogs

 

# purge all remote messages from queue, and let the loghost process its local logs.

if $fromhost-ip != '127.0.0.1' then ~

 

/etc/rsyslog.d/send-to-loghost.conf

*.* @@loghost0.x.y.z:601

*.* @@loghost1.x.y.z:601