Here's what I did:

Question

3

Rsyslog filter for logging router events (syslog server)

rated 0 times [ 3] [ 0] / answers: 1 / hits: 22210 / 2 Years ago, wed, june 8, 2022, 8:12:00

I am trying to configure rsyslog (Ubuntu 12.04 Server) to log events from a router. I found this old ubuntu forum post which got me most of the way there.

So far I am able to get the events logged from the router. However since I don't them logged in /var/log/syslog I am trying to set up a working filter in /etc/rsyslog.conf to put the logged events in /var/log/linksys.log. This is where I am having trouble.

First I tried filtering by the router ip address like this:
```
:fromhost-ip, isequal, "192.168.2.1" /var/log/linksys.log

& ~
```
This successfully redirects the logs as I wanted, the only problem is now I am not getting any SSHD logs in auth.log. Needless to say this is not acceptable.

Next I tried filtering by the router name which appears in every event log:
```
:msg,contains, "RV042" /var/log/linksys.log

& ~
```
Although this neither logs or blocks anything.

So I am stumped. I have no idea why SSHD is getting filtered with the :fromhost-ip filter. SSHD is local on the machine with rsyslog (192.168.2.2). I am thoroughly frustrated by this, any suggestions are much appreciated.

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

ainlyyor

Add To Favorites

Follow

Total Points: 210

Total Questions: 129

Total Answers: 116

Location: Barbados

Member since Sun, Nov 27, 2022

1 Year ago

answered 2 Years ago antebrow · Accepted Answer

I figured it out! These links helped:

http://www.rsyslog.com/tag/udp/

http://www.rsyslog.com/doc/multi_ruleset.html

Here's what I did:

Opened up /etc/rsyslog.d/50-default.conf and at the top of the file, before other all of the default filters, I added:

# process remote messages

# define new ruleset and add rules to it:

$RuleSet remote

*.*           /var/log/linksys.log

# only messages not from 192.168.2.1 make it past this point



# bind ruleset to UDP listener

$InputUDPServerBindRuleset remote

# and activate it:

$UDPServerRun 514



# switch back to the default ruleset:

$RuleSet RSYSLOG_DefaultRuleset