Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have rules such as:

 if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog

and don't want to output messages that go into that log to /var/log/syslog as well. Is that possible?

share|improve this question
I see the same behaviour with lines like this in /etc/rsyslog.conf: $template FILENAME,"/var/log/remotes/%HOSTNAME%/syslog.log" *.* ?FILENAME – Cera Aug 15 '13 at 1:09
up vote 4 down vote accepted

The discard (~) action may help.http://www.rsyslog.com/doc/rsyslog_conf_actions.html

if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog
if $hostname startswith 'd.42ba7373' and $programname == 'app' then ~
share|improve this answer
This almost does what I personally need, but it's hard to make its behaviour nuanced: I basically want /var/log/remotes/%HOSTNAME%/syslog.log for remotes, but /var/log/syslog if it's from the master. I'm happy to hard-code the FQDN of the master in the config file todo this, but I can't figure out the conditionals. – Cera Aug 15 '13 at 6:51
@Cerales - how do you want this question answered? It's different than the one originally asked here, and you put a bounty on this Q. Seems like it should've been its own Q. I have some ideas on how to accomplish this but they don't fit this Q. – slm Aug 17 '13 at 4:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.