3

I'm running Fedora (F19) and my /var/log/messages is filled with info coming from avahi-daemon: stuff like:

Jan 21 14:13:42 localhost avahi-daemon[554]: Invalid response packet from host 10.10.22.3.

from my local network

since I read somewhere that it's harmless, but I don't have time at the moment to debug it, I thought about disabling the reporting by modifying /etc/rsyslog.conf.

I modified this line:

*.info;mail.none;authpriv.none;cron.none   /var/log/messages

to this line

*.info;mail.none;authpriv.none;cron.none;avahi-daemon.none   /var/log/messages

but with the new line rsyslog doesn't work anymore!

systemctl restart rsyslog reports it as running, but nothing gets ever written in messages - doing stuff that normally gets reported, as stopping & restarting some process (e.g. systemctl restart cups), nothing gets reported.

If I restore the rsyslog.conf line as before, the restart of cups gets reported.

Is there some problem in the way I modified that line?

2

These:

*.info;mail.none;authpriv.none;cron.none

Are traditional syslog style facility.priority pairs. I like rsyslogd, but while it does have documentation, those docs are idiosyncratic in form and atrociously organized1 and I have no idea at what point, wading through them haphazardly, new users are supposed to learn this. I think the presumption is you are already familiar with how traditional syslog works, which is unfortunate since those man pages won't be on a system that started out using rsyslogd.

Anyway, here's an online man syslog.conf with which rsyslog should be compatible. Note that there is a short, finite, hard-coded list of facilities not including "avahi-daemon". I.e., facility != just some tag or label used in logging.

You can filter messages via substring matching and discard them (this is rsyslog specific):

:msg, contains, "avahi-daemon" ~

That needs to be before all the "Log by facility" rules, so that the message is discarded first. The relevant scrap of documentation is here.

However, that matches substrings in the message, and in this case, "avahi-daemon" is actually a prepended tag (see, e.g, -t in man logger) that's not part of msg. Other possible properties are listed here and the compare-operations here. So perhaps:

:syslogtag, isequal, "avahi-daemon" ~

Will be the most effective.

There's a different method of "filtering by program name" in the wiki. I don't know if that is going to be any more efficient.


1. Perhaps the presumption is that search engines be your primary guide...eliminating the need for any coherent organization.

  • Thank you, I tried it immediately. I found a good reference also at rsyslog.com/doc/rsyslog_conf_filter.html ... unfortunately, it doesnt work: rsyslog ignores the line (which I put before the /var/log/messages line) – alessandro Jan 23 '14 at 8:30
  • got it! You only missed that avahi-daemon is not in :msg, but in :syslogtag, so the correct line is ':syslogtag, contains, "avahi-daemon" ~', and it works! – alessandro Jan 23 '14 at 9:34
  • Cheers -- did not know about those distinctions! I've edited in some stuff for posterity. – goldilocks Jan 23 '14 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.