Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have rules such as:

 if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog

and don't want to output messages that go into that log to /var/log/syslog as well. Is that possible?

share|improve this question
    
I see the same behaviour with lines like this in /etc/rsyslog.conf: $template FILENAME,"/var/log/remotes/%HOSTNAME%/syslog.log" *.* ?FILENAME –  Cerales Aug 15 '13 at 1:09
add comment

1 Answer 1

up vote 3 down vote accepted
+50

The discard (~) action may help.http://www.rsyslog.com/doc/rsyslog_conf_actions.html

if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog
if $hostname startswith 'd.42ba7373' and $programname == 'app' then ~
share|improve this answer
    
This almost does what I personally need, but it's hard to make its behaviour nuanced: I basically want /var/log/remotes/%HOSTNAME%/syslog.log for remotes, but /var/log/syslog if it's from the master. I'm happy to hard-code the FQDN of the master in the config file todo this, but I can't figure out the conditionals. –  Cerales Aug 15 '13 at 6:51
    
@Cerales - how do you want this question answered? It's different than the one originally asked here, and you put a bounty on this Q. Seems like it should've been its own Q. I have some ideas on how to accomplish this but they don't fit this Q. –  slm Aug 17 '13 at 4:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.