1

I have following Rsyslog config to send logs to remote servers. Problem is its sending lots of INFO mesg to remote server and i don't want that noise. I am trying to configure filter so it send all severity logs but not INFO.

# Ansible managed

$WorkDirectory /var/spool/rsyslog
$template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"

# Log shipment rsyslog target servers
$ActionQueueFileName ostack-log-01_rsyslog_container-04cb9e3a
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount 250
local7.* @172.28.1.205:514;RFC3164fmt

This is what i did and it didn't work.

local7.*;local7.!=info @172.28.1.205:514;RFC3164fmt

My OS is Centos7.5 Linux

  • Try running in debug mode rsyslogd -dn and sending a single item. There is a lot of trace output that may give some clue as to what is happening. – meuh Aug 15 at 15:36
  • My problem is its production server and trying to avoid running anything call debug :( let me see if i can poke in dev. Do you think my syntax is correct local7.*;local7.!=info ? – Satish Aug 15 at 15:42
  • 1
    Yes the syntax seems ok to me. It is quite possible to run a separate rsyslogd process as a simple user if you copy the config file and reduce it to a minimum using say imuxsock to listen on a socket file, and then sending to it with logger --socket ... I'm sorry I don't have an example to link to. – meuh Aug 15 at 15:54
  • @meuh i found issue why its keep sending info logs because syslog severity is saying mesg is notice but inside logs its saying INFO that got me confused. let me add that in my answer section so it will help other folks too, Thanks for the logger hint. – Satish Aug 15 at 16:44
0

This is what happened here, my syslog messages saying INFO logs but in tcpdump i found syslog severity saying notice and that was my side confusion.

local7.*;local7.!=notice;local7.!=info @172.28.1.205:514;RFC3164fmt

This is how we can test this rules, using logger tool to generate fake logs

logger -p 'local7.info' 'This is info logs, Reject it'
logger -p 'local7.notice' 'This is notice logs, Reject it'
logger -p 'local7.error' 'This is error logs and Accept it'
-1

You may want to restart rsyslog service after updating it with the filters, if you didn't already did that.

Restart the rsyslog service after updating the rsyslog.conf file.

# service rsyslog restart        # CentOS/RHEL 6
# systemctl restart rsyslog
  • its obvious i have restarted services after changes. – Satish Aug 15 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.