This is somewhat related to my previous question here.
I have three files in
/etc/rsyslog.d which is included from
The first one is one that I created. My assumption is/was, that due to the naming it will be included before
50-default.conf, but I also tried putting the filter lines directly into
50-default.conf and remove my custom file (
:msg, startswith, "ipt:" /var/log/iptables.log & stop
stop as running
-N1 as described on the man page and in the troubleshooting steps gave a warning, saying
~ is deprecated in favor or
stop, which means the available (official!) documentation seems to be outdated/lagging behind.
Now the idea here is that any message prefixed with
ipt: will go into the named log file and no other log file will receive these lines (I tried also
contains instead of
startswith). That is in particular
kern.log mentioned in
50-default.conf shouldn't receive those messages anymore:
auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog kern.* -/var/log/kern.log
I read the rsyslog documentation, but documentation for the property-based filters (also here) isn't exactly the most enlightening. The example given in the documentation (also found elsewhere) and their Wiki gives a similar example:
# From documentation *.* /var/log/allmsgs-including-informational.log :msg, contains, "informational" ~ *.* /var/log/allmsgs-but-informational.log # From Wiki :syslogtag, startswith, "MSWinEventLog#011" /var/log/messages;fixsnareFormat & @192.168.1.8;fixsnareForwardFormat & ~
While the example from the documentation isn't as close to my two-liner, it still explains the meaning of the
What am I doing wrong?
Bonus points if someone can answer whether there is a way to combine selectors and properties. E.g.:
:msg, startswith, "ipt:" kern.* /var/log/iptables.log
NB: I use version 7.4.4 of
rsyslog. And yes, I did
service rsyslog restart after the changes and then waited for it to take effect.
Some more info. When running the daemon in debug mode (
RSYSLOG_DEBUG=LogFuncFlow RSYSLOG_DEBUGLOG=~/rsl.log $(which rsyslogd) -f /etc/rsyslog.conf -d), I can see that the ruleset after optimization looks like this, which seems to indicate it's exactly the way I want it (leading prefix stripped for brevity):
ruleset 'RSYSLOG_DefaultRuleset' after optimization: ruleset 0x214a640: rsyslog ruleset RSYSLOG_DefaultRuleset: PROPFILT Property.: 'rawmsg' Operation: 'contains' Value....: 'ipt:' THEN ACTION 0x215c070 [builtin:omfile:/var/log/iptables.log] STOP END PROPFILT PRIFILT 'auth,authpriv.*' pmask: X X X X FF X X X X X FF X X X X X X X X X X X X X X ACTION 0x215e840 [builtin:omfile:/var/log/auth.log] END PRIFILT PRIFILT '*.*;auth,authpriv.none' pmask: FF FF FF FF X FF FF FF FF FF X FF FF FF FF FF FF FF FF FF FF FF FF FF FF ACTION 0x215f030 [builtin:omfile:-/var/log/syslog] END PRIFILT
I should also add that from the behavior I see, I can deduce that the filter has an effect, as it clearly writes into the file
/var/log/iptables.log as expected. However, the messages aren't dropped as expected after writing them to that particular file.
Here's an example line the way it ends up in all of
iptables.log as opposed to only the latter. Details have been redacted for privacy reasons:
Jun 1 02:23:01 hostname kernel: [70025.211497] ipt:drop IN=eth0 OUT=virbr0 MAC=dd:cc:bb:aa:99:88:77:66:55:44:33:22:11:00 SRC=220.127.116.11 DST=18.104.22.168 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=59201 DF PROTO=TCP SPT=47626 DPT=23 WINDOW=4380 RES=0x00 SYN URGP=0