Configuring and Managing System Logs in SUSE Linux Enterprise

Change the configuration of rsyslog to route the local3 and local5 logs:

sudo vim /etc/rsyslog.conf

Edit the line that contains the reference to the files.

Change:

local2.*;local3.* . -/var/log/localmessages

To:

local2.*   -/var/log/localmessages
local3.* . -/var/log/local3evtx

And change:

local4.*;local5.* . -/var/log/localmessages

To:

local4.*   -/var/log/localmessages
local5.* . -/var/log/local5evtx

Save and write the file.

Restart rsyslog:

sudo systemctl restart rsyslog

Confirm the local3evt and local5evt files do not exist:

ls /var/log

Then have rsyslog route messages to the respective files:

sudo logger -p local3.info 'this is a test'
sudo logger -p local5.info 'this is a test'

Verify the files were both created and contain the test messages:

ls /var/log

sudo cat /var/log/local3evtx

sudo cat /var/log/local5evtx