I am trying to get some logging in place and am trying to troubleshoot it and this question became relevant.

I use rsyslog config files to redirect some of my logging. (Will use iptables logging since I am working with it but please assume the general case)

Under my rsyslog.d config I have

:msg, startswith, "iptables: " /var/log/iptables.log
:msg, startswith, "iptables denied: " /var/log/iptables.log
& ~

I would assume if this was working that it would no longer log to kern.log.

Since it is no longer going to kern.log does the redirect also effect the kernel ring buffer?

  • You may have to use contains and not startswith -- the kernel will likely append its own time stamp to iptables stuff before rsyslog sees it.
    – goldilocks
    Feb 15, 2013 at 16:21

2 Answers 2


The & only applies to the preceeding selector, so you will need one for each of those :msg lines.



No, it only affects what you modified.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .