2

I get duplication on a remote rsyslog server: Even though I've configured a catch for clamav logs from mail servers - I still get the logs appearing in syslog

# Configuration for Mail ClamAV logs in rsyslog.d
if ($fromhost contains "mail") and ($programname contains "clam") then {
   action(type="omfile" file="/var/log/mail-clam.log")
}

mail-clam.log:

Jan  3 11:32:07 mail2 freshclam[265]: Received signal: wake up
Jan  3 11:32:07 mail2 freshclam[265]: ClamAV update process started at Thu Jan  3 11:32:07 2019
Jan  3 11:32:07 mail2 freshclam[265]: main.cld is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
Jan  3 11:32:07 mail2 freshclam[265]: daily.cld is up to date (version: 25264, sigs: 2197013, f-level: 63, builder: raynman)
Jan  3 11:32:07 mail2 freshclam[265]: bytecode.cld is up to date (version: 328, sigs: 94, f-level: 63, builder: neo)

syslog:

Jan  3 11:32:07 mail2 freshclam[265]: Received signal: wake up
Jan  3 11:32:07 mail2 freshclam[265]: ClamAV update process started at Thu Jan  3 11:32:07 2019
Jan  3 11:32:07 mail2 freshclam[265]: main.cld is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
Jan  3 11:32:07 mail2 freshclam[265]: daily.cld is up to date (version: 25264, sigs: 2197013, f-level: 63, builder: raynman)
Jan  3 11:32:07 mail2 freshclam[265]: bytecode.cld is up to date (version: 328, sigs: 94, f-level: 63, builder: neo)

I've got the following line exluding logs in rsyslog.conf:

*.*;auth,authpriv,mail.none     -/var/log/syslog

I'm not sure how to exlude $programname from syslog? What would be the correct way to approach this?

*.*;auth,authpriv,mail.none,if ($programname contains "clam") then {}     -/var/log/syslog

Or can reference the if statement somehow?

1

The rules in the rsyslog configuration file are evaluated from top to bottom. So, you can achieve selective logging by simply dropping the log message after the necessary processing. The 'stop' action is used to discard the log message.

In your case, modify your rsyslog.conf file to this:

if ($fromhost contains "mail") and ($programname contains "clam") then {
   action(type="omfile" file="/var/log/mail-clam.log")
   stop
}

...

*.*;auth,authpriv,mail.none     -/var/log/syslog

With this configuration, all messages that match the expression are logged to /var/log/mail-clam.log and then discarded. This will prevent these messages from being processed further, and therefore being logged to /var/log/syslog.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.