2

I have a Tomato router and it has the capability to have its logs go to a external server. syslog is the obvious choice for this. So I enabled remote logging on my linux server's syslogd (syslogd -r) and I can see all of the logs in /var/log/syslog. What I want to do is take everything that comes from the IP of my router (10.0.0.1) and divert it to its own file like /var/log/tomato to avoid polluting my syslog with external logs.

I can't find any examples of someone doing this. My only solution is to get a script together that strips out any line in /var/log/syslog with 10.0.0.1 in it and puts the line into /var/log/tomato and have the script run as a cron job, but that seems unnecessarily messy.

There's got to be a better way.

Edit:

Unless someone knows that there is a solution, I'm 95% sure that syslog doesn't support this after reading more in-depth of the man page. So I need to migrate to syslog-ng or make a crazy script that runs with cron.

Reti
  • 131
  • 2

2 Answers2

1

We are using syslog-ng at my office and indeed, you can segregate the output of syslog based on all kinds of different criterias to different output files. In syslog-ng, you basically define the sources, the criteria and destination separately. You then make the rule that will glue different components together to make an actual rule to be executed by syslog-ng.

For what I see, syslog-ng seems to be the def acto standard. We are also using a PHP-based syslog reader that works over the web, using Apache. You can then read those syslogs, using your own criteria to review the log content in a way that is perhaps easier than the famous "tail -f" command. This is known as PHPlogcon. Google the name and you should easily find it.

jfmessier
  • 2,770
  • 5
  • 26
  • 31
1

Use iptables to divert traffic from your router ip to some different port on your linux host.

On that other port (i.e. 5514) run another instance of syslog server and write . to file of your choice.

damir
  • 205
  • 2
  • 7