We have a requirement to write incoming debug messages to our rsyslog server, but not forward them on to our Splunk server. I have tried putting *.debug stop in front of our local rules, but that is not working. Any ideas how to prevent .debug messages from being forwarded.
1 Answer
I assume that you work with include config files. This makes order of processing very important. Details are in the rsyslog include documentation.
Based on this assumption I guess that you do the *.debug stop
at a place after the messages has already been forwarded.
Alternatively, you may use a very old version which does not understand stop
. In this case, you can do *.debug ~
, which is the very-old style equivalent.
flags(final);
would be the key in thelog
entities.