Rsyslog - prevent local host logging twice

Question

I've enabled remote logging in my rsyslog.conf with:

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

and then in /etc/rsyslog.d/devices.conf, I have

$template RemoteLogs,"/var/log/devices/%HOSTNAME%.log" 
*.*  ?RemoteLogs

I'm finding though that the local machine (the rsyslog server) is logging its events not just to the relevant /var/log/filename but also /etc/log/devices/pi.log

How do i prevent the logs in /etc/log/devices/ for the local host (called pi) please?

Thanks

Answer 1

When specifying the input, also say which ruleset to apply. Input outside the ruleset will not be processed by the ruleset, and vice-versa.

module(load="imudp")
input(type="imudp" port="514" ruleset="remote")
ruleset(name="remote"){
 $template RemoteLogs,"/var/log/devices/%HOSTNAME%.log" 
 *.*  ?RemoteLogs
}

Answer 2

the ruleset solution didn't work for me. all messages still show up in /var/log/messages. However this solution worked for me. basically, this line filtered out all messages come from a particular host.

:hostname, contains, "myhostname"  ~