I have rules such as:
if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog
and don't want to output messages that go into that log to /var/log/syslog as well. Is that possible?
2 Answers
The discard (~) action may help.http://www.rsyslog.com/doc/rsyslog_conf_actions.html
if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/applog
if $hostname startswith 'd.42ba7373' and $programname == 'app' then ~
-
This almost does what I personally need, but it's hard to make its behaviour nuanced: I basically want
/var/log/remotes/%HOSTNAME%/syslog.logfor remotes, but/var/log/syslogif it's from the master. I'm happy to hard-code the FQDN of the master in the config file todo this, but I can't figure out the conditionals.– CeraAug 15, 2013 at 6:51 -
@Cerales - how do you want this question answered? It's different than the one originally asked here, and you put a bounty on this Q. Seems like it should've been its own Q. I have some ideas on how to accomplish this but they don't fit this Q.– slm ♦Aug 17, 2013 at 4:12
-
1For folks viewing this answer in 2023, a modern rsyslog generates warnings when using ~, and offers that you should use 'stop' instead. Jan 16 at 12:48
A similar issue is here. The above answer is going to work perfectly if the drop action is done in the main rsyslog conf file, which in case of ubuntu 14.04 with rsyslog 7.4.4 is /etc/rsyslog.conf. If anyone is using a separate conf file altogether, it should be named such that it comes before 50-default.conf filename in the dictionary order, because the 50-default.conf file contains config for putting the logs to /var/log/syslog.
$template FILENAME,"/var/log/remotes/%HOSTNAME%/syslog.log"*.* ?FILENAME