0

I posted this question in the Superuser community but maybe this forum is better suited to my question:

I'm sending logs to a syslog server, but cron logs there are taking up more space than they should (and I don't need to see them). Every hour, I get messages like

starting 0anacron
finished 0anacron

Other messages are like

(CRON) ERROR chdir failed

I tried going into my rsyslog config file and found that most of these logs are in /var/log/rsyslog. I've found sources online that suggested I do the following, so I've added these lines in the rsyslog config:

cron.none.*                                             -/var/log/rsyslog
cron.*                                                  -/var/log/rsyslog
cron.*                                                  -/var/log/cron.log

and restarted rsyslog but I'm still getting cron logs on my syslog server. I've tried adding *.*; before the "cron" part of each line, but that doesn't work either. This is also in my rsyslog config file:

*.cron.none                                                 /var/log/messages

but nothing's working. Does anyone know how to stop cron logs so I don't get them on my syslog server?

1 Answer 1

1

The order of lines in rsyslog's config is important.

cron.none.*                                             -/var/log/rsyslog
cron.*                                                  -/var/log/rsyslog
cron.*                                                  -/var/log/cron.log

The first line means put messages from cron regardless of priority into /var/log/rsyslog without syncing. And that is it. The message was processed and the second and third lines do not play anymore.

You need to remove (comment out) the first two lines and leave just the third one for cron messages be sent to /var/log/cron.log

If you want cron to be ignored completely, you can use a magic word 'stop':

cron.*   stop

For more info, go to man 5 rsyslog.conf and man 3 syslog

1
  • So does 'stop' stop cron logs from getting to syslog? I want the cron processes to keep running (and the logs can still be generated), but I just don't want to receive its logs on my syslog server. (The cron logs aren't in /var/log/messages.)
    – user532591
    Jul 5, 2022 at 16:35

You must log in to answer this question.