2023-12-22 21:53:42 +00:00
|
|
|
# Receive logs
|
2024-04-02 20:48:55 +00:00
|
|
|
# Logs will appear as /var/log/remote/hostname.example.com-{secure,messages}.log
|
2023-12-22 21:53:42 +00:00
|
|
|
module(load="imtcp")
|
|
|
|
|
module(load="imudp")
|
2024-04-02 20:48:55 +00:00
|
|
|
$AllowedSender UDP, {{ allowed_rsyslog_clients|join(', ') }}
|
2023-12-22 21:53:42 +00:00
|
|
|
$AllowedSender TCP, {{ allowed_rsyslog_clients|join(', ') }}
|
|
|
|
|
|
2024-04-02 20:48:55 +00:00
|
|
|
template(name="TmplAuth" type="string" string="/var/log/remote/%FROMHOST%-secure.log")
|
2023-12-22 21:53:42 +00:00
|
|
|
|
2024-04-02 20:48:55 +00:00
|
|
|
template(name="TmplMsg" type="string" string="/var/log/remote/%FROMHOST%-messages.log")
|
|
|
|
|
|
|
|
|
|
# Process the equivalent of /var/log/{messages,secure} on a given system
|
|
|
|
|
ruleset(name="remote_1_log"){
|
|
|
|
|
authpriv.* action(type="omfile" DynaFile="TmplAuth")
|
|
|
|
|
*.info;mail.none;authpriv.none;cron.none action(type="omfile" DynaFile="TmplMsg")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
input(type="imtcp" port="514" ruleset="remote_1_log")
|
|
|
|
|
input(type="imudp" port="514" ruleset="remote_1_log")
|
