1

I'm using the following rsyslog configuration file to redirect logs of a program to a specific file.

# Name of the program
set $.program_name = "myapp";

# Path to the log file
set $.logfile_path = "/var/log/myapp.log";

# Templates 
$template log_file, "%$.logfile_path%"
$template datetime_message, "[%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day%_%timestamp:::date-hour%_%timestamp:::date-minute%_%timestamp:::date-second%.%timestamp:0:3:date-subseconds%]%msg%\n"

# Program log redirection
if( ($programname == $.program_name)) then
{
    ?log_file;datetime_message
}

Since I don't have a lot of storage available and that the program generates a lot of logs, the file is regularly rotated using logrotate, compressed and then sent to a server with a large storage capacity so the partition mounted on /var never saturates.

It was working pretty well until I realized that even if logs are redirected to the file they are also sent into /var/log/messages, /var/log/syslog and /var/log/user.log.

So the logs are duplicated into four different files, with three of them not being rotated regularly, thus leading to a partition saturation pretty fast.

I searched for a way to send logs only to /var/log/myapp.log but I didn't find anything. Also I would like to avoid modifying /etc/rsyslog.conf and only modify the specific rsyslog configuration file located at /etc/rsyslog.d/99-myapp.conf.

How could I tell syslog that all logs from myapp shall be sent only into /var/log/myapp.log and not in any other file ?

1 Answer 1

1

Having selected a message, and provided an action for it, you can stop further processing of that message by adding the stop action:

if( ($programname == $.program_name)) then
{
    ?log_file;datetime_message
    stop
}

This can be done in your file if is included from the main config file (for example, with $IncludeConfig /etc/rsyslog.d/*.conf) before any other actions, which is normally the case. Look for the word "discard" in the documentation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .