2

How can I discard multiple messages at once using rsyslog? This doesn't work and I'm unable to find a working example:

# Do not log any keepass and chmomium messages
if $programname == 'chromium.desktop'       then /dev/null
if $programname == 'keepass2.desktop'       then /dev/null

& stop

The solution below works, but shows an error when checking with rsyslogd -N1 -f <config_file>

rsyslogd: version 8.4.2, config validation run (level 1), master config /etc/rsyslog.d/00-discard.conf
rsyslogd: CONFIG ERROR: there are no active actions configured. Inputs will run, but no output whatsoever is created. [try http://www.rsyslog.com/e/2103 ]
rsyslogd: run failed with error -2103 (see rsyslog.h or try http://www.rsyslog.com/e/2103 to learn what that number means)
Improve this question

2 Answers 2

Reset to default
3

The line & stop means "repeat the previous selector", and do action "stop" which stops further processing of the selected message. So you would need to put it after each if ... selecting line. However, since your action is to write to /dev/null, you may as well make the first line do what you want, i.e.

if $programname == 'chromium.desktop'       then stop
if $programname == 'keepass2.desktop'       then stop
Improve this answer
3
  • This works, but config check using -N1 -f <config_file> results in rsyslogd: version 8.4.2, config validation run (level 1), master config /etc/rsyslog.d/00-discard.conf rsyslogd: CONFIG ERROR: there are no active actions configured. Inputs will run, but no output whatsoever is created. [try http://www.rsyslog.com/e/2103 ] rsyslogd: run failed with error -2103 (see rsyslog.h or try http://www.rsyslog.com/e/2103 to learn what that number means)
    – Jan
    Commented Dec 26, 2016 at 22:28
  • I would have thought you should only get this error if you have no other logging rules, or if you test an included file independently of the main configuraton.
    – meuh
    Commented Dec 27, 2016 at 10:23
  • Well, that's what it is - an included file, only a part of the config, so everything is OK.
    – Jan
    Commented Dec 28, 2016 at 11:49
2

There is another way to discard messages described here: Discarding unwanted messages

Instead of check the "msg" property as in the example, just check the "programname" property.

:programname, contains, "chromium.desktop" ~

:programname, contains, "keepass2.desktop" ~

Improve this answer
1
  • but in this manner you cannot combine conditions, correct?
    – Gaia
    Commented Aug 26, 2019 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .