1

How can I discard multiple messages at once using rsyslog? This doesn't work and I'm unable to find a working example:

# Do not log any keepass and chmomium messages
if $programname == 'chromium.desktop'       then /dev/null
if $programname == 'keepass2.desktop'       then /dev/null

& stop

The solution below works, but shows an error when checking with rsyslogd -N1 -f <config_file>

rsyslogd: version 8.4.2, config validation run (level 1), master config /etc/rsyslog.d/00-discard.conf
rsyslogd: CONFIG ERROR: there are no active actions configured. Inputs will run, but no output whatsoever is created. [try http://www.rsyslog.com/e/2103 ]
rsyslogd: run failed with error -2103 (see rsyslog.h or try http://www.rsyslog.com/e/2103 to learn what that number means)
1

The line & stop means "repeat the previous selector", and do action "stop" which stops further processing of the selected message. So you would need to put it after each if ... selecting line. However, since your action is to write to /dev/null, you may as well make the first line do what you want, i.e.

if $programname == 'chromium.desktop'       then stop
if $programname == 'keepass2.desktop'       then stop
  • This works, but config check using -N1 -f <config_file> results in rsyslogd: version 8.4.2, config validation run (level 1), master config /etc/rsyslog.d/00-discard.conf rsyslogd: CONFIG ERROR: there are no active actions configured. Inputs will run, but no output whatsoever is created. [try http://www.rsyslog.com/e/2103 ] rsyslogd: run failed with error -2103 (see rsyslog.h or try http://www.rsyslog.com/e/2103 to learn what that number means) – Jan Dec 26 '16 at 22:28
  • I would have thought you should only get this error if you have no other logging rules, or if you test an included file independently of the main configuraton. – meuh Dec 27 '16 at 10:23
  • Well, that's what it is - an included file, only a part of the config, so everything is OK. – Jan Dec 28 '16 at 11:49
2

There is another way to discard messages described here: Discarding unwanted messages

Instead of check the "msg" property as in the example, just check the "programname" property.

:programname, contains, "chromium.desktop" ~

:programname, contains, "keepass2.desktop" ~

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.