I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so:

peterh$ echo test log message|logger

then I get this in /var/log/messages:

Oct 12 16:38:29 thehost peterh: test log message

Where "thehost" is the hostname of the server, and "peterh" is the user name below I gave the command.

Now what I want: I want to collect the log entries of a specific user into a specific file with the syslog-ng.

The bad-looking, but sometimes working features of the syslog-ng to filter the whole log entry didn't work:

# Doesn't work - it doesn't do anything
filter f_peterh { match('peterh'); };
destination d_filter { file("/var/log/peterh.log"); };
log { source(s_src); filter(f_peterh); destination(d_peterh); };

The documentation available manywhere on the net talk about everything from the binary format of the log messages until the related RFCs, except that how can I filter the syslog for user names.

How to do it?

  • Logger puts your username in for where the daemon usually goes. Are you looking to capture people who are running logger (and not overriding the username)?
    – Jeff Schaller
    Commented Oct 12, 2018 at 15:36
  • @JeffSchaller Yes. Actually, I want to run a wonderful software capable to log only to stdout/stderr, on a way that it runs as a daemon and I see its output in the syslog. To do that, I am wrapping it with a script, pipe its output to a logger command, and run this script as a daemon. The daemon will run as a specific user, this user exists only for this daemon. Now I want to separate its log entries into its file. If I could filter for the user, it would be a very nice and simple setting in the syslog-ng - but the syslog-ng documentation is a little bit cloudy, unfortunately.
    – peterh
    Commented Oct 12, 2018 at 15:48
  • @JeffSchaller (simply redirecting the output of the daemon into a logfile is a no-go, there is also a network logging and an alarm/security watch system behind that, and anyways I see no reason to do something sub-optimally because a good software with a trash doc).
    – peterh
    Commented Oct 12, 2018 at 15:52
  • it seems to me that you'd have to match() against the MESSAGE, unless MSGHDR contains more than rfc3164 specifies as the header , since I don't (yet) see syslog-ng support for rfc5424's APP-NAME
    – Jeff Schaller
    Commented Oct 12, 2018 at 16:08
  • @JeffSchaller Probably this should be reached, however the question is, how could I make syslog-ng to filter for that? The basic "match" filter won't work, but if syslog-ng can write this into the syslog, then it surely should be able to also filter for that. But how? The syslog-ng doc talks about everything, except that.
    – peterh
    Commented Oct 12, 2018 at 16:36

1 Answer 1


I don't know if this is still on going for you, but for reference for anyone else trying to filter by username, this is how I was able to do it.

I created the following filter.

filter sampleUserFilter {
        facility (user) and match ("myUser" value ("PROGRAM"));

That allowed me to route messages from a specific user (using logger) to a separate file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .