I want to use negation to stop certain messages to be passed on the rsyslog bassed on the $rawmsg.

Message exaple like:

(root) CMD (LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok)

I tried but not working:

if $rawmsg !contains '(root) CMD ' then  ?wcc-logs
& stop

It relates to previous post

1 Answer 1


You need to group the expression correctly. In script, you need to use "not" instead of "!". Also, the not must precede the to-be-negated expression. So correct syntax is

if not ($rawmsg contains '(root) CMD ') then  {

I have used the parenthesis solely for clarification. I have modernized the if a bit to use the block syntax, which IMHO is easier to grasp.

Doc on script syntax: https://www.rsyslog.com/doc/v8-stable/rainerscript/index.html

  • Thanks @rainer, what does it mean the not must precede the to-be-negated expression ?
    – Karn Kumar
    Feb 16, 2019 at 18:48
  • yes, exactly. This is the case- Mar 16, 2019 at 11:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .