I'm working on an pre-existing installation of rsyslog. I am not sure what remote hosts are sending log files to the server. Some of the folders have unhelpful names like 'last', 'Server', 'syslogd', and 'exiting'. How do I track down where these are coming from (e.g. useful log files, etc.)? /etc/rsyslog.conf:  #  Default rules for rsyslog.##           For more information see rsyslog.conf(5) and /etc/rsyslog.conf## First some standard log files.  Log by facility.#auth,authpriv.*         /var/log/auth.log*.*;auth,authpriv.none      -/var/log/syslog#cron.*             /var/log/cron.log#daemon.*           -/var/log/daemon.logkern.*              -/var/log/kern.log#lpr.*              -/var/log/lpr.logmail.*              -/var/log/mail.log#user.*             -/var/log/user.log## Logging for the mail system.  Split it up so that# it is easy to write scripts to parse these files.##mail.info          -/var/log/mail.info#mail.warn          -/var/log/mail.warnmail.err            /var/log/mail.err## Logging for INN news system.#news.crit           /var/log/news/news.critnews.err            /var/log/news/news.errnews.notice         -/var/log/news/news.notice## Some catch-all log files.##*.=debug;\#   auth,authpriv.none;\#   news.none;mail.none -/var/log/debug#*.=info;*.=notice;*.=warn;\#   auth,authpriv.none;\#   cron,daemon.none;\#   mail,news.none      -/var/log/messages## Emergencies are sent to everybody logged in.#*.emerg                                :omusrmsg:*## I like to have messages displayed on the console, but only on a virtual# console I usually leave idle.##daemon,mail.*;\#   news.=crit;news.=err;news.=notice;\#   *.=debug;*.=info;\#   *.=notice;*.=warn   /dev/tty8# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,# you must invoke `xconsole' with the `-file' option:# #    $ xconsole -file /dev/xconsole [...]## NOTE: adjust the list below, or you'll go crazy if you have a reasonably#      busy site..##daemon.*;mail.*;\#   news.err;\#   *.=debug;*.=info;\#   *.=notice;*.=warn   |/dev/xconsoleubuntu@rsyslog:/mnt/data/rsyslog/hosts/last/2013/12/31$ cat /etc/rsyslog.conf #  /etc/rsyslog.conf    Configuration file for rsyslog.##           For more information see#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html##  Default logging rules can be found in /etc/rsyslog.d/50-default.conf##################### MODULES #####################$ModLoad imuxsock # provides support for local system logging$ModLoad imklog   # provides kernel logging support#$ModLoad immark  # provides --MARK-- message capability# provides UDP syslog reception#$ModLoad imudp#$UDPServerRun 514# provides TCP syslog reception#$ModLoad imtcp#$InputTCPServerRun 514# Enable non-kernel facility klog messages$KLogPermitNonKernelFacility on############################### GLOBAL DIRECTIVES ################################# Use traditional timestamp format.# To enable high precision timestamps, comment out the following line.#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat# Filter duplicated messages$RepeatedMsgReduction on## Set the default permissions for all log files.#$FileOwner syslog$FileGroup adm$FileCreateMode 0640$DirCreateMode 0755$Umask 0022$PrivDropToUser syslog$PrivDropToGroup syslog## Where to place spool and state files#$WorkDirectory /var/spool/rsyslog## Include all config files in /etc/rsyslog.d/#$IncludeConfig /etc/rsyslog.d/*.conf/etc/rsyslog.d/60-remote.conf:$WorkDirectory /mnt/data/rsyslog/queue # default location for work (spool) files$DefaultNetstreamDriver gtls$DefaultNetstreamDriverCAFile /etc/rsyslog.d/ssl/XXXXX.pem$DefaultNetstreamDriverCertFile /etc/rsyslog.d/ssl/XXXXXX.crt$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/ssl/XXXXXX.key$ModLoad imudp$ModLoad imtcp$template syslog,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog$template apacheError,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/apache-error.log$template apacheAccess,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/apache-access.log$template auth,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/auth.log$template kern,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/kern.log$template mail,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/mail.log$template daemon,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/daemon.log$RuleSet remote$ActionQueueType LinkedList   # use asynchronous processing$ActionQueueFileName logstash # set file name, also enables disk mode$ActionResumeRetryCount -1    # infinite retries on insert failure$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down$ActionQueueMaxFileSize 100m$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)$ActionQueueDequeueSlowdown 0$ActionQueueWorkerThreads 4*.* @@logstash.anotherdomain.comlocal7.* ?apacheError& ~local6.notice ?apacheAccess& ~auth,authpriv.* ?auth& ~kern.* ?kern& ~mail.* ?mail& ~daemon.* ?daemon& ~*.* ?syslog$InputTCPServerStreamDriverMode 1$InputTCPServerStreamDriverAuthMode anon$InputTCPServerBindRuleset remote$InputTCPServerRun 1514$InputUDPServerBindRuleset remote$UDPServerRun 514
rsyslog - what host is sending these files?
linux;rsyslog
All of the forwarding in rsyslog.conf, the stuff that looks like this:auth,authpriv.*         /var/log/auth.logis going to log files without a hostname. The stuff in 60-remote.conf, that looks like this:`auth,authpriv.* ?authis going to the log files defined by the templates such as this:$template auth,/var/rsyslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/auth.logSo it appears there are two different systems in place, with a lot of overlap. The stuff in rsyslog.conf is the default, and the stuff in 60-remote.conf is another nearly-complete system.As I understand it, hosts send events, not files. Each log event in the files may or may not have a hostname in it right after the timestamp (they do in most default configurations). The events are put in the files by the local syslog daemon.