rsyslog discard message

Question

I'm trying to discard any "kernel: nfs: Deprecated parameter 'intr'" messages from /var/log/messages Rsyslog version: 8.1911.0-6.el8

In my /etc/rsyslog.conf file I have the following:

module(load="imuxsock"    # provides support for local system logging (e.g. via logger command)
       SysSock.Use="off") # Turn off message reception via local log socket;
                          # local messages are retrieved through imjournal now.
module(load="imjournal"             # provides access to the systemd journal
       StateFile="imjournal.state") # File to store the position in the journal

global(workDirectory="/var/lib/rsyslog")

module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

include(file="/etc/rsyslog.d/*.conf" mode="optional")

:msg, contains, "nfs: Deprecated parameter"  stop

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

authpriv.*                                              /var/log/secure

mail.*                                                  -/var/log/maillog

cron.*                                                  /var/log/cron

*.emerg                                                 :omusrmsg:*

uucp,news.crit                                          /var/log/spooler

local7.*                                                /var/log/boot.log

The line that should discard the messages is:

:msg, contains, "nfs: Deprecated parameter" stop

I still see that the messages getting logged. Any ideas? PS., I do have additional conf files in /etc/rsyslog.d/ if that matters.

Answer 1

Discarding specific messages with property-based filters.

Property-based filters are unique to rsyslod. They allow to filter on any property, like HOSTNAME, syslogtag and msg.

To discard messages use a tilde "~".

*.info;mail.none;authpriv.none;cron.none                   /var/log/messages
:msg, contains, "nfs: Deprecated parameter" ~
*.info;mail.none;authpriv.none;cron.none                   /var/log/kern.log

The specified messages are written to messages. Then, all logs containing the string “nfs: deprecated” are discarded. That means the config file lines below the “discard line” will not be applied to this message. Then, all remaining lines will also be written to the file kern.

---

In your case it's possible that the messages still get logged (due to the additional .conf files in /etc/rsyslog.d/. So if you want to be 100% sure that messages containing "nfs: Deprecated parameter" do not get logged, you have to check and (maybe) edit them too.

P.S. you probably want to look for all rules containing *.info