I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn
, info
and debug
and the rest of the messages I want to be accepted.
I have below config which partially shows template
and Rules
to be checked.
In the below config I have commented the all the Custom conditional Forwarding
because I have other hostnames starts with different names. So, I'm thinking about the way if I can only discard warn
, info
and debug
and rest to come.
$template wcc-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
#### RULES ############################################
# Log anything (except mail) of level info or higher.#
# Don't log private authentication messages! #
####################################################
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
#if $fromhost startswith "wc" then {
# *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
# & stop
#}
#if $fromhost startswith "sj" then -?wcc-logs
#& stop
#if $fromhost startswith "vlsj-" then -?wcc-logs
#& stop
In the above configuration you may see I'm using the below Rules in the RULES section assuming that everything should be logged except the First line:
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs *.* ?wcc-logs
rsyslogd 8.24.0