Table of Contents

1. Challenge

   Configure rsyslog to Send All `local3` Messages to `/var/log/local3evtx` and All `local5` Messages to `/var/log/local5evtx`

   1. Change the configuration of rsyslog to route the local3 and local5 logs:

      sudo vim /etc/rsyslog.conf
      

   2. Edit the line that contains the reference to the files.

      Change:

      local2.*;local3.* . -/var/log/localmessages
      

      To:

      local2.*   -/var/log/localmessages
      local3.* . -/var/log/local3evtx
      

      And change:

      local4.*;local5.* . -/var/log/localmessages
      

      To:

      local4.*   -/var/log/localmessages
      local5.* . -/var/log/local5evtx
      

      Save and write the file.

   3. Restart rsyslog:

      sudo systemctl restart rsyslog
      

2. Challenge

   Use the `logger` Command to Verify the Logs Are Being Routed Correctly

   1. Confirm the local3evt and local5evt files do not exist:

      ls /var/log
      

   2. Then have rsyslog route messages to the respective files:

      sudo logger -p local3.info 'this is a test'
      sudo logger -p local5.info 'this is a test'
      

   3. Verify the files were both created and contain the test messages:

      ls /var/log
      
      sudo cat /var/log/local3evtx
      
      sudo cat /var/log/local5evtx