From 262111689f19e362100236a37bcd3c7eed6fd769 Mon Sep 17 00:00:00 2001
From: Michael Meckelein A program specification is a line beginning with ‘!prog’ and the following
blocks will be associated with calls to syslog from that specific program. A
program specification for ‘foo’ will also match any message logged by the kernel
-with the prefix ‘foo: ’. A hostname specification of the form ‘+hostname’ and
+with the prefix ‘foo: ’. Alternatively, a program specification ‘-foo’ causes the
+following blocks to be applied to messages from any program but the one specified.
+
+A hostname specification of the form ‘+hostname’ and
the following blocks will be applied to messages received from the specified
hostname. Alternatively, a hostname specification ‘-hostname’ causes the
following blocks to be applied to messages from any host but the one specified.
+
If the hostname is given as ‘@’, the local hostname will be used. (NOT YET
IMPLEMENTED) A program or hostname specification may be reset by giving the
program or hostname as ‘*’.
+
*.* ?DynFile
-
+
That's all you need to do. Rsyslog will now automatically generate file names for you and store the right messages into the right files. Please note that the minus sign also works with dynamic file name selectors. Thus, to avoid syncing, you may use
-
-*.* -?DynFile
+*.* -?DynFile
And of course you can use templates to specify the output format:
-
-*.* ?DynFile;MyTemplate
+*.* ?DynFile;MyTemplate
A word of caution: rsyslog creates files as needed. So if a new host is using your syslog server, rsyslog will automatically create a new file for -it. However, directories are never created. So if you use a dynamic -directory name, you must make sure that all possible directories are created, -otherwise the writes will fail. This restriction will most probably be removed -in later versions of rsyslogd.
+it. + +Creating directories is also supported. For example you can use the hostname as directory +and the program name as file name:
+
+$template DynFile,"/var/log/%HOSTNAME%/%programname%.log"
+
This version of rsyslogd(8) has support for logging output to named pipes (fifos).
A fifo or named pipe can be used as a destination for log messages by prepending
@@ -806,4 +813,4 @@ defining such features is available
in rsyslogd, only.