syslog ip ranges to specific files using `rsyslog`

Posted by Mike Pennington on Server Fault See other posts from Server Fault or by Mike Pennington
Published on 2012-06-19T20:20:01Z Indexed on 2012/06/19 21:18 UTC
Read the original article Hit count: 289

Filed under:
|
|
|

I have many Cisco / JunOS routers and switches that send logs to my Debian server, which uses rsyslogd.

How can I configure rsyslogd to send these router / switch logs to a specific file, based on their source IP address? I do not want to pollute general system logs with these entries.

For instance:

  • all routers in Chicago (source ip block: 172.17.25.0/24) to only log to /var/log/net/chicago.
  • all routers in Dallas (source ip block 172.17.27.0/24) to only log to /var/log/net/dallas.

Finally, these logs should be rotated daily for up to 30 days and compressed.


NOTE: I am answering my own question

© Server Fault or respective owner

Related posts about linux

Related posts about networking