This is somewhat related to my previous question here.
I have three files in /etc/rsyslog.d
which is included from /etc/rsyslog.conf
:
00-iptables.conf
50-default.conf
postfix.conf
The first one is one that I created. My assumption is/was, that due to the naming it will be included before 50-default.conf
, but I also tried putting the filter lines directly into 50-default.conf
and remove my custom file (00-iptables.conf
).
:msg, startswith, "ipt:" /var/log/iptables.log
& stop
Replaced ~
with stop
as running rsyslogd
with -N1
as described on the man page and in the troubleshooting steps gave a warning, saying ~
is deprecated in favor or stop
, which means the available (official!) documentation seems to be outdated/lagging behind.
Now the idea here is that any message prefixed with ipt:
will go into the named log file and no other log file will receive these lines (I tried also contains
instead of startswith
). That is in particular syslog
and kern.log
mentioned in 50-default.conf
shouldn't receive those messages anymore:
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
kern.* -/var/log/kern.log
I read the rsyslog documentation, but documentation for the property-based filters (also here) isn't exactly the most enlightening. The example given in the documentation (also found elsewhere) and their Wiki gives a similar example:
# From documentation
*.* /var/log/allmsgs-including-informational.log
:msg, contains, "informational" ~
*.* /var/log/allmsgs-but-informational.log
# From Wiki
:syslogtag, startswith, "MSWinEventLog#011" /var/log/messages;fixsnareFormat
& @192.168.1.8;fixsnareForwardFormat
& ~
While the example from the documentation isn't as close to my two-liner, it still explains the meaning of the ~
better.
What am I doing wrong?
Bonus points if someone can answer whether there is a way to combine selectors and properties. E.g.:
:msg, startswith, "ipt:" kern.* /var/log/iptables.log
NB: I use version 7.4.4 of rsyslog
. And yes, I did service rsyslog restart
after the changes and then waited for it to take effect.
Edit
Some more info. When running the daemon in debug mode (RSYSLOG_DEBUG=LogFuncFlow RSYSLOG_DEBUGLOG=~/rsl.log $(which rsyslogd) -f /etc/rsyslog.conf -d
), I can see that the ruleset after optimization looks like this, which seems to indicate it's exactly the way I want it (leading prefix stripped for brevity):
ruleset 'RSYSLOG_DefaultRuleset' after optimization:
ruleset 0x214a640: rsyslog ruleset RSYSLOG_DefaultRuleset:
PROPFILT
Property.: 'rawmsg'
Operation: 'contains'
Value....: 'ipt:'
THEN
ACTION 0x215c070 [builtin:omfile:/var/log/iptables.log]
STOP
END PROPFILT
PRIFILT 'auth,authpriv.*'
pmask: X X X X FF X X X X X FF X X X X X X X X X X X X X X
ACTION 0x215e840 [builtin:omfile:/var/log/auth.log]
END PRIFILT
PRIFILT '*.*;auth,authpriv.none'
pmask: FF FF FF FF X FF FF FF FF FF X FF FF FF FF FF FF FF FF FF FF FF FF FF FF
ACTION 0x215f030 [builtin:omfile:-/var/log/syslog]
END PRIFILT
I should also add that from the behavior I see, I can deduce that the filter has an effect, as it clearly writes into the file /var/log/iptables.log
as expected. However, the messages aren't dropped as expected after writing them to that particular file.
Here's an example line the way it ends up in all of kern.log
, syslog
and iptables.log
as opposed to only the latter. Details have been redacted for privacy reasons:
Jun 1 02:23:01 hostname kernel: [70025.211497] ipt:drop IN=eth0 OUT=virbr0 MAC=dd:cc:bb:aa:99:88:77:66:55:44:33:22:11:00 SRC=9.8.7.6 DST=1.2.3.4 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=59201 DF PROTO=TCP SPT=47626 DPT=23 WINDOW=4380 RES=0x00 SYN URGP=0