I have this kind of logs
May 13 17:39:34 192.168.x.254 2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.249:2050 (gi1/0/2 68:05:ca:10:14:87) -> 192.168.x.255:2050 dscp 0, 1 packets
May 13 17:39:34 192.168.x.254 2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.244:5678 (gi1/0/2 d4:ca:6d:da:2e:bb) -> 255.255.255.255:5678 dscp 0, 5 packets
It fetched from router via syslog to my debian server
In rsyslog config on server i added lines:
template (name="bsdlogformat" type="string" string="%hostname% %timereported% %syslogtag%%msg%\n")
template (name="fileformat" type="string" string="/var/log/rsyslogs/%HOSTNAME%-%syslogtag%.log")
:hostname, isequal, "192.168.x.254" ?fileformat;bsdlogformat
All works fine, except that filename creader like that:
192.168.x.254-.log
and result is:
192.168.x.254 May 13 17:39:34 2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.249:2050 (gi1/0/2 68:05:ca:10:14:87) -> 192.168.x.255:2050 dscp 0, 1 packets
192.168.x.254 May 13 17:39:34 2020-05-13T17:50:47+00:00 %FIREWALL-I-LOG: zone-pair 'WAN self' rule 10000 denied udp 192.168.x.244:5678 (gi1/0/2 d4:ca:6d:da:2e:bb) -> 255.255.255.255:5678 dscp 0, 5 packets
So it did not detect %syslogtag%
Main problem here string
2020-05-13T17:50:47+00:00
I can't find way to force syslod thisks that its a date.
ow i can fix it?
I found solution, it actually simple:
template(name="bsdlogformat" type="list") {
property(name="fromhost-ip")
constant(value=" ")
property(name="msg")
constant(value="\n")
}
template (name="fileformat" type="string" string="/var/log/rsyslogs/%HOSTNAME%-main.log")
template (name="firewallfile" type="string" string="/var/log/rsyslogs/%HOSTNAME%-firewall.log")
template (name="authfile" type="string" string="/var/log/rsyslogs/%HOSTNAME%-auth.log")
template (name="sshfile" type="string" string="/var/log/rsyslogs/%HOSTNAME%-ssh.log")
if ($fromhost-ip == "192.168.0.254") then {
if ($msg contains "FIREWALL-I-LOG") then {
action(type="omfile" dynaFile="firewallfile" Template="bsdlogformat")
} else if ($msg contains "AAA-LOCAL-N-AUTH") then {
action(type="omfile" dynaFile="authfile" Template="bsdlogformat")
} else if ($msg contains "AAA-LOCAL-W-AUTH") then {
action(type="omfile" dynaFile="authfile" Template="bsdlogformat")
} else if ($msg contains "AAA-E-SSH") then {
action(type="omfile" dynaFile="sshfile" Template="bsdlogformat")
} else if ($msg contains "AAA-I-SSH") then {
action(type="omfile" dynaFile="sshfile" Template="bsdlogformat")
} else {
action(type="omfile" dynaFile="fileformat" Template="bsdlogformat")
}
stop
}
It just checks $msg and based on contain string put logs in files with prefixes.