I have the following lines in the 50-default.conf file (in /etc/rsyslog.d):

local0.emerg       stop
*.emerg            :omusrmsg:*

But all local0 messages are still being sent to every user logged on the system. I can't seem to find any filter that will tell rsyslog to stop sending those local0 messages to omusrmsg.

I have confirmed that the log msgs really are using local0 (they are also being written to a log file, which writes the facility value also). I have also confirmed that :omusrmsg: is not used on any other line in the rsyslog config, unless there is a config file hiding somewhere (the only config files I see are /etc/rsyslog.conf and 4 files in the /etc/rsyslog.d directory, and 2 of those 4 files are mine).

I have also tried these entries in that conf file, before the :omusrmsg: line:

local0.*     stop
if ( ( $syslogseverity <= '0' ) and ( $syslogfacility-text == 'local0' ) ) then stop
if ( ( $syslogseverity <= '0' ) and ( $syslogfacility == '16' ) ) then stop
if ( ( $syslogseverity == '0' ) and ( $syslogfacility == '16' ) ) then stop

I have restarted rsyslogd (via sudo service rsyslog restart) many times. And I have made other changes to the rsyslog config that work fine. Other than this, all logging seems to work fine.

Can someone tell me what I'm doing wrong? Any help would be much appreciated.

I am running rsyslogd 8.16.0 on Ubuntu 16.04.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.