I have rules such as:

 if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog

and don't want to output messages that go into that log to /var/log/syslog as well. Is that possible?

  • I see the same behaviour with lines like this in /etc/rsyslog.conf: $template FILENAME,"/var/log/remotes/%HOSTNAME%/syslog.log" *.* ?FILENAME
    – Cera
    Commented Aug 15, 2013 at 1:09

2 Answers 2


The discard (~) action may help.http://www.rsyslog.com/doc/rsyslog_conf_actions.html

if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog
if $hostname startswith 'd.42ba7373' and $programname == 'app' then ~
  • This almost does what I personally need, but it's hard to make its behaviour nuanced: I basically want /var/log/remotes/%HOSTNAME%/syslog.log for remotes, but /var/log/syslog if it's from the master. I'm happy to hard-code the FQDN of the master in the config file todo this, but I can't figure out the conditionals.
    – Cera
    Commented Aug 15, 2013 at 6:51
  • @Cerales - how do you want this question answered? It's different than the one originally asked here, and you put a bounty on this Q. Seems like it should've been its own Q. I have some ideas on how to accomplish this but they don't fit this Q.
    – slm
    Commented Aug 17, 2013 at 4:12
  • 1
    For folks viewing this answer in 2023, a modern rsyslog generates warnings when using ~, and offers that you should use 'stop' instead. Commented Jan 16, 2023 at 12:48

A similar issue is here. The above answer is going to work perfectly if the drop action is done in the main rsyslog conf file, which in case of ubuntu 14.04 with rsyslog 7.4.4 is /etc/rsyslog.conf. If anyone is using a separate conf file altogether, it should be named such that it comes before 50-default.conf filename in the dictionary order, because the 50-default.conf file contains config for putting the logs to /var/log/syslog.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .