How to redirect rsyslog messges from a specific unix socket to a different log file without duplication?

Question

I have been trying to implement separate logging for haproxy. But I end up with duplicate logging and can't separate logs based on the input socket or facility alone.

My sample configuration in haproxy:

Global configuration:

log                           /dev/log len 1024 format local local0 debug

Frontend -1 configuration (for Web requests):

log                           /dev/request-log len 1024 format local local1 debug

Frontend-2 configuration (for DB requests):

log                           /dev/db-log len 1024 format local local2 debug

So here I was basically trying to redirect logs to different sockets and additionally I also used different facilities for each, because I don't know how to redirect messages based on input socket.

And in rsyslog configuration, I added the following:

$AddUnixListenSocket /var/lib/haproxy/dev/log
local0.* /var/log/haproxy/haproxy.log
$AddUnixListenSocket /var/lib/haproxy/dev/request-log
local2.* /var/log/haproxy/requests.log
$AddUnixListenSocket /var/lib/haproxy/dev/db-log
local3.* /var/log/haproxy/db.log

But all the above log files have the same logging i.e., web request logging, db logging and other haproxy logging all are duplicated in these three files.and including default /var/log/messages.

Complete rsyslog.conf:

$ModLoad imuxsock
$ModLoad imjournal
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$SystemLogSocketName /run/systemd/journal/syslog
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
local1.* /var/log/keepalived.log
$AddUnixListenSocket /var/lib/haproxy/dev/log
local0.* /var/log/haproxy/haproxy.log
$AddUnixListenSocket /var/lib/haproxy/dev/request-log
local2.* /var/log/haproxy/requests.log
$AddUnixListenSocket /var/lib/haproxy/dev/db-log
local3.* /var/log/haproxy/db.log

Note: Same issue with keepalived.log also which is mentioned in the above config.

I see logging works correctly without any duplication if I use something like this instead of using facility:

:programname, startswith, "haproxy" {
  /var/log/haproxy/haproxy.log
  stop
}

But it is unwanted extra processing when it could be easy to filter out messages based on input socket or facility name. Can anyone help me understand why the duplication is happening, but not in the case for other default sections like cron, mail, authpriv etc. where there is no duplication. Or how to redirect messages based on socket input?

Answer 1

Restricting processing is done with rulesets. These allow you to group a set of filters together and apply them only to a given input. Filters outside of a ruleset only receive the other input as usual. Though you can use legacy syntax for rulesets, it is a bit easier in RainerScript style, for example:

ruleset(name="rule1"){
  *.* action(type="omfile" file="output1")
}
ruleset(name="rule2"){
  *.* action(type="omfile" file="output2")
}
input(type="imuxsock" socket="/tmp/sock1" Ruleset="rule1")
input(type="imuxsock" socket="/tmp/sock2" Ruleset="rule2")
*.* -./output3

This configuration would read socket /tmp/sock1 and apply ruleset rule1 which matches all lines and puts them in file output1. Similarly, sock2 data gets put in output2, and the normal input gets put in output3.

So replace your last 6 lines with

ruleset(name="rule1"){
  *.* action(type="omfile" file="/var/log/haproxy/haproxy.log")
}
input(type="imuxsock" socket="/var/lib/haproxy/dev/log" Ruleset="rule1")

and so on. You don't need to filter on local0 and so on, as you should only get those lines anyway.