rsyslog conf file problem

Question

I'm running Fedora (F19) and my /var/log/messages is filled with info coming from avahi-daemon: stuff like:

Jan 21 14:13:42 localhost avahi-daemon[554]: Invalid response packet from host 10.10.22.3.

from my local network

since I read somewhere that it's harmless, but I don't have time at the moment to debug it, I thought about disabling the reporting by modifying /etc/rsyslog.conf.

I modified this line:

*.info;mail.none;authpriv.none;cron.none   /var/log/messages

to this line

*.info;mail.none;authpriv.none;cron.none;avahi-daemon.none   /var/log/messages

but with the new line rsyslog doesn't work anymore!

systemctl restart rsyslog reports it as running, but nothing gets ever written in messages - doing stuff that normally gets reported, as stopping & restarting some process (e.g. systemctl restart cups), nothing gets reported.

If I restore the rsyslog.conf line as before, the restart of cups gets reported.

Is there some problem in the way I modified that line?

Answer 1

These:

*.info;mail.none;authpriv.none;cron.none

Are traditional syslog style facility.priority pairs. I like rsyslogd, but while it does have documentation, those docs are idiosyncratic in form and atrociously organized¹ and I have no idea at what point, wading through them haphazardly, new users are supposed to learn this. I think the presumption is you are already familiar with how traditional syslog works, which is unfortunate since those man pages won't be on a system that started out using rsyslogd.

Anyway, here's an online man syslog.conf with which rsyslog should be compatible. Note that there is a short, finite, hard-coded list of facilities not including "avahi-daemon". I.e., facility != just some tag or label used in logging.

You can filter messages via substring matching and discard them (this is rsyslog specific):

:msg, contains, "avahi-daemon" ~

That needs to be before all the "Log by facility" rules, so that the message is discarded first. The relevant scrap of documentation is here.

However, that matches substrings in the message, and in this case, "avahi-daemon" is actually a prepended tag (see, e.g, -t in man logger) that's not part of msg. Other possible properties are listed here and the compare-operations here. So perhaps:

:syslogtag, isequal, "avahi-daemon" ~

Will be the most effective.

There's a different method of "filtering by program name" in the wiki. I don't know if that is going to be any more efficient.

---

^{1. Perhaps the presumption is that search engines be your primary guide...eliminating the need for any coherent organization.}