I have rules such as:

 if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog

and don't want to output messages that go into that log to /var/log/syslog as well. Is that possible?

  • I see the same behaviour with lines like this in /etc/rsyslog.conf: $template FILENAME,"/var/log/remotes/%HOSTNAME%/syslog.log" *.* ?FILENAME – Cera Aug 15 '13 at 1:09

The discard (~) action may help.http://www.rsyslog.com/doc/rsyslog_conf_actions.html

if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog
if $hostname startswith 'd.42ba7373' and $programname == 'app' then ~
  • This almost does what I personally need, but it's hard to make its behaviour nuanced: I basically want /var/log/remotes/%HOSTNAME%/syslog.log for remotes, but /var/log/syslog if it's from the master. I'm happy to hard-code the FQDN of the master in the config file todo this, but I can't figure out the conditionals. – Cera Aug 15 '13 at 6:51
  • @Cerales - how do you want this question answered? It's different than the one originally asked here, and you put a bounty on this Q. Seems like it should've been its own Q. I have some ideas on how to accomplish this but they don't fit this Q. – slm Aug 17 '13 at 4:12

A similar issue is here. The above answer is going to work perfectly if the drop action is done in the main rsyslog conf file, which in case of ubuntu 14.04 with rsyslog 7.4.4 is /etc/rsyslog.conf. If anyone is using a separate conf file altogether, it should be named such that it comes before 50-default.conf filename in the dictionary order, because the 50-default.conf file contains config for putting the logs to /var/log/syslog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.