syslog ip ranges to specific files using `rsyslog`
- by Mike Pennington
I have many Cisco / JunOS routers and switches that send logs to my Debian server, which uses rsyslogd.
How can I configure rsyslogd to send these router / switch logs to a specific file, based on their source IP address? I do not want to pollute general system logs with these entries.
For instance:
all routers in Chicago (source ip block: 172.17.25.0/24) to only log to /var/log/net/chicago.
all routers in Dallas (source ip block 172.17.27.0/24) to only log to /var/log/net/dallas.
Finally, these logs should be rotated daily for up to 30 days and compressed.
NOTE: I am answering my own question