0

I am planning to add filters in rsyslog.conf to redirect the syslog messages based on a tag so that I can log using logger and redirect to a custom log file.

configuration in rsyslog.conf looks something like below,

:syslogtag, isequal, "xyz:" /var/log/custom/custom.log

Now my questions is, since there are many subsystems and scripts we might end up adding lot of filters in rsyslog.conf. will it affect the performance?

is it a good practice to use rsyslog for custom logs?

1

I'm in the same boat and was only going to use compare rules on local only. the only thing i have read is to put stop after each rule. so when a match is found it will stop checking more rules.

Now the stop method depends on your version.

newer its stop

olderis tilde i think

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.