{"id":12346,"date":"2023-11-30T19:03:00","date_gmt":"2023-11-30T14:03:00","guid":{"rendered":"https:\/\/alexeyka.zantsev.com\/?p=12346"},"modified":"2023-11-30T16:51:46","modified_gmt":"2023-11-30T11:51:46","slug":"rsyslog-redirect-logs-from-certain-host-to-a-separate-file","status":"publish","type":"post","link":"https:\/\/alexeyka.zantsev.com\/?p=12346","title":{"rendered":"rsyslog: redirect logs from certain host to a separate file"},"content":{"rendered":"\n<p>Linksys PAP2T-NA phone adapter is configured to send logs to a remote syslog server 10.11.0.10.<\/p>\n\n\n\n<p>Enable UDP listener in <font color=\"cf2e2e\">\/etc\/rsyslog.conf<\/font> and allow in it&#8217;s config a remote ip\/subnet address:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted has-vivid-red-color has-text-color\">module(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\")\n$AllowedSender TCP, 10.11.0.0\/16<\/pre>\n\n\n\n<p>Here is how logs look like after this (and sure after configuring your server&#8217;s ip as a syslog server on the remote device).  Most likely they will appear in <font color=\"cf2e2e\">\/var\/log\/syslog<\/font> :<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-red-color has-text-color\"><code>Nov 25 15:39:19 10.11.13.102 &#91;1: 0]RTP Tx Dn<br>Nov 25 15:39:19 10.11.13.102 &#91;1: 0]ENC INIT 8<br>Nov 25 15:39:19 10.11.13.102 &#91;1: 0]RTP Tx Up (pt=8-&gt;0a48000a:18076)<br>Nov 25 15:39:19 10.11.13.102 CC: Remote Resume<br>Nov 25 15:39:19 10.11.13.102 CC: Connected<br>Nov 25 15:39:19 10.11.13.102 RTP: SSRC changed 787a1882-&gt;1df25275<br>Nov 25 15:39:29 10.11.13.102 syscfg_update_hdlr!!! <br>Nov 25 15:39:29 10.11.13.102 syscfg_update_hdlr!!! <br>Nov 25 15:39:51 10.11.13.102 syscfg_update_hdlr!!! <\/code><\/pre>\n\n\n\n<p class=\"has-black-color has-text-color\"><br>To redirect logs from remote host with ip address 10.11.13.102 do the following:<\/p>\n\n\n\n<p class=\"has-black-color has-text-color\"><br>Create <font color=\"cf2e2e\">\/etc\/rsyslog.d\/11-linksys-gw.conf<\/font> with the following lines:<br><\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-red-color has-text-color\"><code><br>if $fromhost-ip == '10.11.13.102' then \/var\/log\/linksys-gw.log<br>&amp; stop<br><\/code><\/pre>\n\n\n\n<p class=\"has-black-color has-text-color\"><br>Create <font color=\"cf2e2e\">\/var\/log\/linksys-gw.log<\/font> empty file. At least in Debian you need to <font color=\"cf2e2e\">chown root:adm<\/font> for this file.<br><br>Finally, restart rsyslog daemon. After that all logs going from remote ip-address 10.11.13.102 will be stored in a separate file.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Linksys PAP2T-NA phone adapter is configured to send logs to a remote syslog server 10.11.0.10. Enable UDP listener in \/etc\/rsyslog.conf and allow in it&#8217;s config a remote ip\/subnet address: module(load=&#8221;imudp&#8221;) input(type=&#8221;imudp&#8221; port=&#8221;514&#8243;) $AllowedSender TCP, 10.11.0.0\/16 Here is how logs look like after this (and sure after configuring your server&#8217;s ip as a syslog server on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[240],"class_list":["post-12346","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-rsyslog"],"_links":{"self":[{"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=\/wp\/v2\/posts\/12346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12346"}],"version-history":[{"count":8,"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=\/wp\/v2\/posts\/12346\/revisions"}],"predecessor-version":[{"id":12354,"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=\/wp\/v2\/posts\/12346\/revisions\/12354"}],"wp:attachment":[{"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/alexeyka.zantsev.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}