How to Filter log based upon log severity in Rsyslog?

user_13515539 0
Viewed 364

I an newbie in rsyslog, i able to get the log from client to server. But I need to divide this as per log severity (means INFO,ERROR, WARN) like this

rsyslog
1 Answers

Try this to add in your rsyslog.conf file in server side

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="50514" ruleset="remote")


Ruleset (name="remote"){
   # action (type="omfile" file="/var/log/jvh.log")          
   if $msg contains 'ERROR' then {
        action (type="omfile" file="/var/log/jvhErr.log")
   }else if $msg contains 'INFO' then {
       action(type="omfile" file="/var/log/jvhInfo.log")
   }else {
        action(type="omfile" file ="/var/log/jvhOther.log")
   }

}

user_31146310
Related