Any rsyslog gurus in the house?
I am trying to collect and organize logs from my Windows servers on my syslog server.
The syslog server is openSUSE Leap 16 using rsyslog, and my Windows servers send their events to it through SolarWinds Event Log Forwarder for Windows.
Ideally, I would like to have a folder for each server, and within that folder will be a log file for security events, a file for windows events, a file for Active Directory events, etc.
As I have it now, my rules are filtering all events from a particular system into a dedicated file, and it's ridiculously painful trying to extract anything useful from them in a timely manner.
I am trying to set up a dynamic file naming structure and filtering rules to handle this, but what I have isn't working and I don't understand why/where I went wrong.
This is what I currently have:
template(name="SolarWindsDynamicPath" type="list") {
constant(value="/var/log/syslog/servers/")
property(name="hostname")
constant(value="/")
property(name="$now")
constant(value="-")
property(
name="msg"
regex.expression="MSWinEventLog#[0-9]+#([A-Za-z0-9 ]+)"
regex.submatch="1"
regex.nomatchmode="FIELD"
caseconversion="lower"
)
constant(value=".log")
}
template(name="CleanLogLine" type="list") {
property(name="timestamp" dateFormat="rfc3339")
constant(value=" ")
property(name="hostname")
constant(value=" ")
property(name="rawmsg" controlcharacters="drop")
constant(value="\n")
}
if ($msg contains "MSWinEventLog") then {
action(type="omfile" dynaFile="SolarWindsDynamicPath" template="CleanLogLine")
stop
}
It passes the rsyslogd syntax check, but it doesn't work and my server logs are just going into the generic 'warn' log file specified in rsyslog.conf.
Any advice is appreciated!
