<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 2/18/24 03:09, Karl Auer wrote:<br>
</div>
<blockquote type="cite"
cite="mid:f6622739dbbd568ac2000c2cfcba74a62d7eb130.camel@biplane.com.au">
<pre class="moz-quote-pre" wrap="">On Sun, 2024-02-18 at 00:57 -0700, R C wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">it didn't like the 'stop' in the script
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Well, that's weird. It's probably worth figuring out what's going on
with that...
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">$template NetworkLogs,"/var/log/network/%HOSTNAME%-messages.log"
*.* ?NetworkLogs
#& stop
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Is this in a separate file in "/etc/rsyslog.d", or in the main file? If
the former, what is the filename? If the latter, post the whole file.</pre>
</blockquote>
this is in a separate file in <span style="white-space: pre-wrap">"/etc/rsyslog.d", and the only two lines are the template and the stop</span>
<blockquote type="cite"
cite="mid:f6622739dbbd568ac2000c2cfcba74a62d7eb130.camel@biplane.com.au">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">However, now it is logging thelocalhost as if it is a remote host
too. I'd don't really like that
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
How is it supposed to tell one set of logging entries (that you want in
your network logs) from all the other logging entries (that you don't
want in your network logs)? It needs something to discriminate on, and
your current selector is "*.*"...</pre>
</blockquote>
right, that was to make it work, to get ir started. I don't know
how to distinguish between remote hosts and the host itself.<br>
<blockquote type="cite"
cite="mid:f6622739dbbd568ac2000c2cfcba74a62d7eb130.camel@biplane.com.au">
<pre class="moz-quote-pre" wrap="">
Regards, K.
</pre>
</blockquote>
</body>
</html>