4

I have set up rsyslog to write messages from local0.* to a separate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile.

I have put the config in rsyslog.d/30-local0.conf, which as far as I know, should come before the 50-default.conf, and so the message should be discarded before hitting the standard rules and being written to syslog?

  • Try manually running rsyslogd -c4 -d and inspect the debugging output. rsyslogd -c4 -d | grep rsyslog.d should show you which files and the order they are included. – forcefsck Apr 6 '11 at 14:13
  • Your problem statement is incomplete - it needs the exact configuration you are testing. Please edit your question to add a [mcve] of a configuration that fails, together with a message (e.g. using the logger command) that you test it with. – Toby Speight Aug 22 '16 at 17:45
1

Sounds correct so far, we may need more data (your actual config files).

Just to be sure, you should have this in 30-local0.conf:

local0.* /var/log/local0.log
       & ~
  • sorry, yeah, that's what my file looks like. Well, the '& ~' isn't indented, but that doesnt matter right? – Duncan Mar 7 '11 at 14:33
  • the config files are standard as far as i know from an ubuntu lucid install. – Duncan Mar 7 '11 at 14:33
  • Indentation doesn't matter; it's only for clarity. – Shawn J. Goff Mar 7 '11 at 15:06
0

Given the date of your question and your distribution you might have been affected by a bug in rsyslog versions < 5.6.5, see Message discarding does not work; the issue has been fixed as of rsyslog version 5.6.5.

Please note, that the default rsyslog package for Ubuntu Lucid is in fact version 4.2.0, but it is not unusual to update rsyslog via a PPA do gain current features (we've been affected by this issue due to rsyslog version 5.6.3 installed from a PPA indeed).

0

On some versions, & ~ (with a space in between) doesn't work, but &~ (no space) does work. (After a restart of the service of course.)

On others still, stop might work instead. But it doesn't on Debian 7 / rsyslog 5.8.11.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.