How to send different access.logs to multiple syslog server

[gpotenza]

Dear community,

hope you're doing well! 

my goal is to send access-logs for Siem to Syslogserver 1 and another type of access-logs (splunk related content) to Syslogserver 2.

Any ideas how to implement?

All the best,

Giuseppe

[Dan28]

Hello,

In our deployment, we added several entries in the rsyslog.conf with syslog servers (via gui, Configuration > File Editor), it does the trick. Hope it helps.

Regards,

[gpotenza]

Hi,

how did you decide which logfile is send to which Syslog-Server? As both the logfiles are set/send to Syslog Level 6. Did you specify an trigger to separate them?

Thanks and greets,

Giuseppe

[gpotenza · Accepted solution]

Hi,

it looks like the only way to solve this, is to configure one log to be send to Syslog severity level 5 (notice) and the other one on syslog severity level 6 (informational) 

Thanks to McAfee support for providing this solution:

SEND SYSLOG TO TWO LOCATIONS EACH WITH UNIQUE FORMATS (Level 6 and Level 5)
- First use best practices to create 1 syslog
- Configure or import two unique log formats under: Policy > Log Handler
- Use syslog Event for one of them with severity 6 (info) Syslog (6, User-Defined.logLine)
- Use syslog Event for the other severity 5 (notice) Syslog (5, User-Defined.logLine)

In rsyslog.conf, exclude both from writing to local disk:
*.info;daemon.!=info;daemon.!=notice;mail.none;authpriv.none;cron.none -/var/log/messages
(This line should already be existing)

And send each stream to its respective recipient using TCP (UDP would be a single @):
daemon.notice @@IP:514
daemon.info;daemon.!=notice @@IP:514
[If you do not include ";daemon.!=notice" in the @@ line, both info & notice will get sent to the "notice" destination.]

Best regards,

Giuseppe