1

I am struggling with dropping certain syslog messages before rsyslog sends them to a remote logging server.

Here is my entire rsyslog.conf file look like this:

# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

:msg, contains, "sudo: pam_unix(sudo:session):" ~
:msg, contains, "sudo:   zabbix : TTY=unknown ; PWD=/ ; USER=root ;" ~

*.*     @192.168.3.2:514

After restarting the service, I continue to get messages on my remote log server for sudo.

Is it even possible to drop messages before they are sent off remotely?

Do I have to use priority based files in rsyslog.d or does the main .conf file work?

I am running Rsyslog 8.2001 on Ubuntu 20.04.3.

Side note: I do know ~ is deprecated, but using stop also did not drop the messages.

1 Answer 1

0

That's because sudo is :programname, and is not in :msg. So, you need to write an expression based filter.

if $programname == 'sudo' and ( $msg contains 'pam_unix(sudo:session)' 
        or $msg contains 'zabbix : TTY=unknown ; PWD=/ ;USER=root' )
then stop

*.*     @192.168.3.2:514
2
  • Very good info, but I think syntax is an issue there. Rsyslog reports syntax error on the then stop line. Knowing that sudo is programname and not msg, I was also able to keep my original filters, and just omitt sudo: from both lines.
    – user432564
    Mar 12, 2022 at 22:15
  • fixed the syntax error, one right brace was missing.
    – RainDoctor
    Mar 13, 2022 at 7:43

You must log in to answer this question.