1

I am struggling with dropping certain syslog messages before rsyslog sends them to a remote logging server.

Here is my entire rsyslog.conf file look like this:

# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

:msg, contains, "sudo: pam_unix(sudo:session):" ~
:msg, contains, "sudo:   zabbix : TTY=unknown ; PWD=/ ; USER=root ;" ~

*.*     @192.168.3.2:514

After restarting the service, I continue to get messages on my remote log server for sudo.

Is it even possible to drop messages before they are sent off remotely?

Do I have to use priority based files in rsyslog.d or does the main .conf file work?

I am running Rsyslog 8.2001 on Ubuntu 20.04.3.

Side note: I do know ~ is deprecated, but using stop also did not drop the messages.

1 Answer 1

1

That's because sudo is :programname, and is not in :msg. So, you need to write an expression based filter.

if $programname == 'sudo' and ( $msg contains 'pam_unix(sudo:session)' 
        or $msg contains 'zabbix : TTY=unknown ; PWD=/ ;USER=root' )
then stop

*.*     @192.168.3.2:514
2
  • Very good info, but I think syntax is an issue there. Rsyslog reports syntax error on the then stop line. Knowing that sudo is programname and not msg, I was also able to keep my original filters, and just omitt sudo: from both lines.
    – ehammer
    Mar 12 at 22:15
  • fixed the syntax error, one right brace was missing.
    – RainDoctor
    Mar 13 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.