rsyslog documentation is very unclear. I want to forward only errors from auditlog to the remote rsyslog server. The examples show:

# auditd audit.log  
$InputFileName /var/log/audit/audit.log  
$InputFileTag tag_audit_log:  
$InputFileStateFile audit_log  
$InputFileSeverity info  
$InputFileFacility local6  

With "InputFileSeverity" set to info, does that mean ALL entries into audit log will show up as info including errors? Or if I set it to "error" does that mean all entries including info will show up as error level?

I only want to see errors forwarded. I feel I am really missing the underlying mechanics on how to set this simple configuration up.

1 Answer 1


Assuming you are using the text file input module for rsyslog, the InputFileSeverity parameter defines the severity stored in rsyslog, NOT the severity of the messages captured in the audit.log file. The file input module does not filter for you. You should configured auditd to only capture "error" level severity in the audit.log file, then set the inputfileseverity to error, and errors from audit.log will be captured by rsyslog at error level severity.

  • Ok, that makes sense. I will try this out. Aug 27, 2015 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .