rsyslog listen on udp:514 + filtering logfile by ip

This snippet is usefull for openWRT setups and other rsyslog sending systems. Add this near head of /etc/rsyslog.conf. ServerAddress is optional

$ModLoad imudp
$UDPServerAddress 10.0.23.43
$UDPServerRun 514

This to /etc/rsyslog.d/aps.conf

:fromhost-ip, isequal, "10.0.23.42"   /var/log/ap-mainhall-ng
& ~

&~ means don't log further that line which match 10.0.23.42. Otherwise it will also log into e.g. /var/log/syslog syslog events. You also use this for a more generic way:

$template DynFile,"/var/log/system-%HOSTNAME%.log"
:fromhost-ip, !isequal, "127.0.0.1"  ?DynFile
& ~

Also usefull if you want to provide a pipe-file for further processing.

:programname, isequal, "freeradius"  |/var/run/rsyslog-freeradius.pipe

links

social