Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to get some logging in place and am trying to troubleshoot it and this question became relevant.

I use rsyslog config files to redirect some of my logging. (Will use iptables logging since I am working with it but please assume the general case)

Under my rsyslog.d config I have

:msg, startswith, "iptables: " /var/log/iptables.log
:msg, startswith, "iptables denied: " /var/log/iptables.log
& ~

I would assume if this was working that it would no longer log to kern.log.

Since it is no longer going to kern.log does the redirect also effect the kernel ring buffer?

share|improve this question
You may have to use contains and not startswith -- the kernel will likely append its own time stamp to iptables stuff before rsyslog sees it. – goldilocks Feb 15 '13 at 16:21
up vote 3 down vote accepted

The & only applies to the preceeding selector, so you will need one for each of those :msg lines.


share|improve this answer

No, it only affects what you modified.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.