Hi I'm trying to filter usb messages, specifically of new connections. all of my clients are configured to send to a central server their 'kern.*' log. problem is I'm getting to much "junk" logs and they accumulate very fast (few gigs a minute). I'm trying to figure out a way to filter these, either on the client/server side. any suggestion is very much appreciated!
Add a filter to the servers configuration so that USB messages go to separate files per client: http://www.rsyslog.com/doc/rsyslog_conf_filter.html