After struggling and googling on the internet I can't manage it to work.
I have stup rsyslog to receive the logging from my firewall and it puts it into the syslog file.
But I would like to have a separate logfile for these messages.

I have created the firwall.log file with owner syslog, same as for the syslog file.

I already have tried to use in the /etc/rsyslog.d/10-firewall.conf the following :
:msg, contains, "firewalld" /var/log/firewall.log
or
:msg, contains, "firewalld" -/var/log/firewall.log
I don't know the difference between the "-" sign in the lines but I have seen also those kind of situations.

I also have put this line into the 50-default.conf file because I thought it wasn't seeing the 10-firewall.conf file but no work.

I have added a $template HostMessages, "/var/log/%HOSTNAME%/logfile.log" in the /etc/rsyslog.conf file but neither it works.

In the firewall I can see the Syslog facility is now on LOG_LOCAL0 and I can change it from LOCAL0, LOCAL1, LOCAL2, ... until LOCAL7
What does these different numbers mean?

Where does it go wrong ?

Most fundamental question. I'd say reading: 'man 3 syslog' (facility: LOG_LOCAL),; 'man syslog.conf' (dash usage), less /usr/share/doc/rsyslog/* and this Rsyslog wiki entry on separating logs: http://wiki.rsyslog.com/index.php/Sy...amic_directory


Did you add a line blow your template redirecting messages from remote hosts to your template?
If unsure just post output from 'grep -v ^# /etc/rsyslog.conf|grep .;'.

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$KLogPath /proc/kmsg
$ModLoad imudp
$UDPServerRun 514
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$IncludeConfig /etc/rsyslog.d/*.conf
$template HostMessages, "/var/log/%HOSTNAME%/logfile.log"

[QUOTE=unSpawn;4260451]Most fundamental question. I'd say reading: 'man 3 syslog' (facility: LOG_LOCAL),; 'man syslog.conf' (dash usage), less /usr/share/doc/rsyslog/* and this Rsyslog wiki entry on separating logs: http://wiki.rsyslog.com/index.php/Sy...amic_directoryQUOTE]

YESS!! thanks for these links, after reading I discoverd some other property replacers to use in /etc/rsyslog.d/10-firewall.conf

:fromhost-ip, contains, "ip.address.from.firewall" /var/log/firewall.log

And I have enabled logrotation for this file.

Thanks!

Great and thanks for marking the thread "solved".