0

This just in continuation of my previous post While working with the rsyslog configuration i have came across many challenges and got to know many caveats of it while most of my config is working now after getting many expertise suggestions, now i have in a dilemma where i want to discard some of the messages out of my filtered messages.

My current rsyslog.conf configuration File:

[root@hos1-loghost ~]# cat  /etc/rsyslog.conf
##########################################################################################
# rsyslog configuration file For PCC &  LPC
##########################################################################################
#### MODULES ####
$ModLoad imuxsock        # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal       # provides access to the systemd journal
$ModLoad imudp           # Provides UDP syslog reception
$UDPServerRun 514        # Provides UDP syslog reception

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
$template system-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
$template dpc-nets,"/scratch/rsyslog/network/%HOSTNAME%/messages.log"
$template dpc-firewalls,"/scratch/rsyslog/firewall/%HOSTNAME%/messages.log"

#################################################
#### GLOBAL DIRECTIVES                       ####
#################################################
$WorkDirectory /var/lib/rsyslog                                 # Where to place auxiliary files
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat        # Use default timestamp format
$IncludeConfig /etc/rsyslog.d/*.conf                            # Include all config files in /etc/rsyslog.d/
$OmitLocalLogging on                                            # local messages are retrieved through imjournal now.
$IMJournalStateFile imjournal.state                             # File to store the position in the journal

############ RULES #########################################
# Log anything (except mail) of level info or higher #######
# Don't log private authentication messages!        ########
############################################################
mail.none;authpriv.none;cron.none ?system-logs
*.*              ?system-logs

#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
if $fromhost startswith "wc" then {
  *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none  ?system-logs
  & stop
}

if $fromhost startswith "sj-" then {
  *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none  ?system-logs
  & stop
}

if $fromhost startswith "vlsj-" then {
  *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none  ?system-logs
  & stop
}

In the above configuration i've multiple if conditions to filter with hostnames along with selecting required facility levels only and discarding others.

Now i've a situation where i have to ignore/discard the messages which contains a particular strings.

Example message set

Feb  8 08:07:01 my-ezure CROND[10487]: (root) CMD (/grid/it/sbin/plugins/new_toplevelmap.sh)
Feb  8 08:08:01 my-ezure CROND[10587]: (root) CMD (/grid/it/sbin/plugins/ps-rem)
Feb  8 08:01:01 my-ezure run-parts(/etc/cron.hourly)[9812 starting mcelog.cron
Feb  8 08:01:01 my-ezure run-parts(/etc/cron.hourly)[9841 finished mcelog.cron
Feb  8 08:08:01 my-ezure CROND[10588]: (root) CMD (/grid/it/sbin/plugins/new_toplevelmap.sh)

From above messages i need to discard the messages which contains CROND , i have tried appending the below line at the end of my rsyslog.conf but did not worked.

if $programname == ' CROND' then stop

if $rawmsg contains ' CROND' then ~

if $syslogfacility-text == ' CROND' then ~

I have rsyslog version: rsyslogd 7.4.7

I want to discard all the unwanted messages from all the client hosts those are on the wire so only to get required message written to my rsyslog server.

  • Would appreciate any comment before downvote? – Karn Kumar Feb 8 at 17:44
  • You need to understand that the commands in your conf file are applied one after the other to the incoming message. In particular you have a line *.* ?system-logs which causes all messages to be saved to that file. Any later filter cannot remove that effect. – meuh Feb 9 at 18:40
  • @meuh, You are absolutely correct , however i'm in a situation where i have not only the hostnames are startswith "sj-" vlsj- or wcc but others which i want move to system-logs apart from these. so saying that if hostnames do not startswith "sj-" vlsj- or wcc then also move then to system-logs or may if i put *.* ?system-logs after filter ? – Karn Kumar Feb 9 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.