0

We have a requirement to write incoming debug messages to our rsyslog server, but not forward them on to our Splunk server. I have tried putting *.debug stop in front of our local rules, but that is not working. Any ideas how to prevent .debug messages from being forwarded.

2
  • 1
    Also I had some fight with rsyslog. Finally I've found that the switch from syslog-ng to rsyslog was a bad decision, I am sorry to say but imho the rsyslog is far from the quality/configurability what we would expect from such an important software. syslog-ng is a well-going and well-configurable log daemon, it is still developed/maintained and works well. There flags(final); would be the key in the log entities.
    – peterh
    Mar 19, 2019 at 23:35
  • Can you show us your configuration file? The order of the log message processing is based on the order of directives in the configuration file.
    – Haxiel
    Mar 20, 2019 at 5:18

1 Answer 1

Reset to default
1

I assume that you work with include config files. This makes order of processing very important. Details are in the rsyslog include documentation.

Based on this assumption I guess that you do the *.debug stop at a place after the messages has already been forwarded.

Alternatively, you may use a very old version which does not understand stop. In this case, you can do *.debug ~, which is the very-old style equivalent.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .