2

I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be accepted.

I have below config which partially shows template and Rules to be checked.

In the below config I have commented the all the Custom conditional Forwarding because I have other hostnames starts with different names. So, I'm thinking about the way if I can only discard warn , info and debug and rest to come.

$template wcc-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
#### RULES ############################################
# Log anything (except mail) of level info or higher.#
# Don't log private authentication messages!        #
####################################################
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none  ?wcc-logs
*.*              ?wcc-logs
#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
#if $fromhost startswith "wc" then {
#  *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none  ?wcc-logs
#  & stop
#}

#if $fromhost startswith "sj" then      -?wcc-logs
#& stop

#if $fromhost startswith "vlsj-" then   -?wcc-logs
#& stop

In the above configuration you may see I'm using the below Rules in the RULES section assuming that everything should be logged except the First line:

 mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none  ?wcc-logs
*.*              ?wcc-logs

rsyslogd 8.24.0

Improve this question
2
  • Just to be clear, you want to discard every log message at the warn, info and debug levels. Is that correct?
    – Haxiel
    Feb 15, 2019 at 16:11
  • @Haxiel, yes, if there was another cases where partial exclusion may happen that would be interesting to see as well.
    – Karn Kumar
    Feb 15, 2019 at 16:41

1 Answer 1

Reset to default
2

You can use the following syntax to drop all messages at the warn, info and debug levels and everything else to be logged using the 'wcc-logs' template:

*.=warn,*.=info,*.=debug                                                stop
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none     ?wcc-logs

The dropped messages will not be available for further processing to any of the following rules in the rsyslog.conf file.

If you want to omit the messages at these levels, but still have them available for further processing for other rules down the line, you can extend the single rule to ignore these specific levels:

*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none,*.!=warn,*.!=info,*.!=debug     ?wcc-logs
Improve this answer
6
  • Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
    – Karn Kumar
    Feb 15, 2019 at 16:48
  • I can even use like *.*,!=info,*.!=debug ?wcc-logs ?
    – Karn Kumar
    Feb 15, 2019 at 16:56
  • @pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use *.notice ?wcc-logs instead.
    – Haxiel
    Feb 15, 2019 at 17:08
  • you mean just to use *.notice ?wcc-logs rather *.*,!=info,*.!=debug ?wcc-logs buy i need warn also excluded ..
    – Karn Kumar
    Feb 15, 2019 at 17:16
  • Sorry for asking too much , i beleive i need all these excluded like you given example *.=notice,*.=warn,*.=info,*.=debug stop i don't even want notice
    – Karn Kumar
    Feb 15, 2019 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .