We have a requirement to write incoming debug messages to our rsyslog server, but not forward them on to our Splunk server. I have tried putting *.debug stop in front of our local rules, but that is not working. Any ideas how to prevent .debug messages from being forwarded.

  • 1
    Also I had some fight with rsyslog. Finally I've found that the switch from syslog-ng to rsyslog was a bad decision, I am sorry to say but imho the rsyslog is far from the quality/configurability what we would expect from such an important software. syslog-ng is a well-going and well-configurable log daemon, it is still developed/maintained and works well. There flags(final); would be the key in the log entities.
    – peterh
    Commented Mar 19, 2019 at 23:35
  • Can you show us your configuration file? The order of the log message processing is based on the order of directives in the configuration file.
    – Haxiel
    Commented Mar 20, 2019 at 5:18

2 Answers 2


I assume that you work with include config files. This makes order of processing very important. Details are in the rsyslog include documentation.

Based on this assumption I guess that you do the *.debug stop at a place after the messages has already been forwarded.

Alternatively, you may use a very old version which does not understand stop. In this case, you can do *.debug ~, which is the very-old style equivalent.


for me the below config worked, and you have to place it in the first configurations that you include

if $pri-text == 'debug' then {

also this link is useful for accessing to all the available variables from the service documentation


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .