[Running Linux Mint 19.3]

I'm trying to work with individual rsyslog priority levels, separating out the messages like this (from /etc/rsyslog.d/50-default.conf):

*.info                         /var/log/syslog-pri/syslog.info
*.notice                       /var/log/syslog-pri/syslog.notice
*.warn                         /var/log/syslog-pri/syslog.warn
*.err                          /var/log/syslog-pri/syslog.err
*.crit                         /var/log/syslog-pri/syslog.crit

This all works great, except there are a few programs that write their messages to multiple priority levels; ufw is the biggest offender, but it's not the only one. Is there a setting in rsyslog that will stop a message from repeating in lower priority levels?

  • I think you mis-understand priority levels; "crit" means "crit or above". Similarly "err" means "err or above". Apps typically only log at a single priority. – Stephen Harris Jan 24 '20 at 4:14
  • That's where I'm having the problem. For example, when I tail syslog or run journalctl, I only get (1) message from ufw about an IP that it blocked. Using my separated log files from above, I get this message in .warn, .info, and .notice. Is that normal? – ajgringo619 Jan 24 '20 at 4:17

For simple filters rsyslog has many extensions to the original BSD version including:

You may precede every priority with an equals sign (“=’‘) to specify only this single priority and not any of the above.

So try *.=err and so on.

  • That did the trick - thank you! – ajgringo619 Jan 24 '20 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.