rSyslog in Ubuntu 11.4
I have enabled rsyslog on Ubuntu and have my firewall logs going to this system. They are landing in the syslog file and I want them to go to a unique file such as /var/log/firewall.log. I have entered the following line in the rsyslog.conf file, but it doesn't seem to have any affect.
if $fromhost-ip isequal '192.168.223.1' then /var/log/192.168.223.1.log
& ~
Does the config file care where I place that line? I have placed it close to the top before the local rule definitions.
Thanks!
Software/Hardware used:
ASA 5520, Ubuntu 11.04
Software/Hardware used:
ASA 5520, Ubuntu 11.04
ASKED:
June 1, 2011 10:51 PM
UPDATED:
June 2, 2011 2:59 PM
Answer Wiki:
I think you should add this rule in front of all others :
:fromhost-ip, isequal, "192.168.223.1" /var/log/remotefile.log
Regards.
To see all answers submitted to the Answer Wiki: View Answer History.
RSS - Discussions Help
Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
