Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup rsyslog to write messages from local0.* to a seperate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile.

I have put the config in rsyslog.d/30-local0.conf, which as far as I know, should come before the 50-default.conf, and so the message should be discarded before hitting the standard rules and being written to syslog?

share|improve this question
Try manually running rsyslogd -c4 -d and inspect the debugging output. rsyslogd -c4 -d | grep rsyslog.d should show you which files and the order they are included. – forcefsck Apr 6 '11 at 14:13

Sounds correct so far, we may need more data (your actual config files).

Just to be sure, you should have this in 30-local0.conf:

local0.* /var/log/local0.log
       & ~
share|improve this answer
sorry, yeah, that's what my file looks like. Well, the '& ~' isn't indented, but that doesnt matter right? – Duncan Mar 7 '11 at 14:33
the config files are standard as far as i know from an ubuntu lucid install. – Duncan Mar 7 '11 at 14:33
Indentation doesn't matter; it's only for clarity. – Shawn J. Goff Mar 7 '11 at 15:06

Given the date of your question and your distribution you might have been affected by a bug in rsyslog versions < 5.6.5, see Message discarding does not work; the issue has been fixed as of rsyslog version 5.6.5.

Please note, that the default rsyslog package for Ubuntu Lucid is in fact version 4.2.0, but it is not unusual to update rsyslog via a PPA do gain current features (we've been affected by this issue due to rsyslog version 5.6.3 installed from a PPA indeed).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.