从 rsyslog 客户端将日志发送到 rsyslog 服务器中的特定文件

Question

I am using rsyslog client to send freeradius logs to rsyslog server. Freeradius logs are stored in /var/log/radius.log in rsyslog client PC. I want to send it to rsyslog server PC. I am using the following setting that is created in a separate freeradius.conf file(manually created) which is present in /etc/rsyslog.d/freeradius.conf folder. The default log file where all logs are sent to server is /var/log/syslog but I want to save log in a separate file. Please help me in saving these logs in /var/log/"CLIENT_IP"/remote_freeradius.log. You can see the content of /etc/rsyslog.d/freeradius.conf file below:

$ModLoad imfile     

$InputFilePollInterval 10 

$InputFileName  /var/log/radius.log 

$InputFileTag freeradius-access: 

$InputFileStateFile stat-freeradius-access 

$InputFileSeverity Info  

$InputRunFileMonitor  


$template freeradius_log, " %msg% "  


if $programname == 'freeradius-access' then @192.168.10.207:514;freeradius_log 

if $programname == 'freeradius-access' then stop

Answer 1

Yes, it's possible to modify the file name when forwarding them.

I don't know if you can achieve the following with legacy syntax - as far as i know, it's not possible. But you can combine legacy and advanced syntax, so it shouldn't be a problem.

---

1st - Create a template:

template (name="ForwardRadiusLogs" type="string"
    string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag% %CLIENT_IP% %msg%")

2nd - Assign the template to the action which forwards the logs

action(type="omfwd" Target="10.100.100.1" Port="20514" Template="ForwardRadiusLogs")

This is the equivalent (in advanced syntax) to the following line in your config:

@192.168.10.207:514;freeradius_log