The collector sorts different machines' lines into directories — by the name written in the line itself.
The second half of lab-collector's configuration says where to write:
A template builds text from a line's properties: %HOSTNAME% is the machine name from the line's header, %PROGRAMNAME% is the program tag (in the Wiki). The omfile action writes to a file, and with dynaFile the template builds the file path anew for every line; rsyslog creates missing directories itself. The sender puts the name in the header, so the web1 and db1 lines that came from address 127.0.0.1 went to their own directories. The address a line came from is a separate property, %FROMHOST-IP%.
A line <13>Oct 22 10:00:00 db1 backup: done reached the collector from 127.0.0.1. Which file will the lab-collector template put it in?
-
ubuntu is the name of the machine the collector runs on. The line's header says db1, and the template takes that.
-
The sender's address is the
%FROMHOST-IP%property, and the template uses%HOSTNAME%— the name from the line's header. -
The template builds the file name from
%PROGRAMNAME%— the program tag in the line, here backup.
The template fills in the machine name and the tag from the line's header: db1 and backup. That is why the web1 and db1 lines at the start of the lesson went to their own directories although they came from one address.
The collector has its own configuration, and you edit it the same way as the main rsyslog's: check the syntax with -f and the file path — sudo rsyslogd -N1 -f /etc/lab-collector/rsyslog.conf — then restart its service. Modules and inputs can be described anywhere in the file, and one template with one action serves lines from all inputs at once: a machine's directory does not depend on whether the line came over TCP or UDP. The same logger with -d helps to test UDP reception.
Take the switch's lines
The sw1 switch can only send syslog over UDP to port 514. Make the lab-collector collector also take lines over UDP on 127.0.0.1:514 and sort them by machine like the rest. TCP reception must stay. The collector's configuration is /etc/lab-collector/rsyslog.conf.
Goals · 0 of 3
- Take lines over UDP not done yet
- Keep TCP reception not done yet
- Keep the collector running with the changed configuration not done yet