I have set up rsyslog to write messages from local0.* to a separate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile.

I have put the config in rsyslog.d/30-local0.conf, which as far as I know, should come before the 50-default.conf, and so the message should be discarded before hitting the standard rules and being written to syslog?

  • Try manually running rsyslogd -c4 -d and inspect the debugging output. rsyslogd -c4 -d | grep rsyslog.d should show you which files and the order they are included.
    – forcefsck
    Apr 6, 2011 at 14:13
  • Your problem statement is incomplete - it needs the exact configuration you are testing. Please edit your question to add a [mcve] of a configuration that fails, together with a message (e.g. using the logger command) that you test it with. Aug 22, 2016 at 17:45

3 Answers 3


Sounds correct so far, we may need more data (your actual config files).

Just to be sure, you should have this in 30-local0.conf:

local0.* /var/log/local0.log
       & ~
  • sorry, yeah, that's what my file looks like. Well, the '& ~' isn't indented, but that doesnt matter right?
    – Duncan
    Mar 7, 2011 at 14:33
  • the config files are standard as far as i know from an ubuntu lucid install.
    – Duncan
    Mar 7, 2011 at 14:33
  • Indentation doesn't matter; it's only for clarity. Mar 7, 2011 at 15:06

Given the date of your question and your distribution you might have been affected by a bug in rsyslog versions < 5.6.5, see Message discarding does not work; the issue has been fixed as of rsyslog version 5.6.5.

Please note, that the default rsyslog package for Ubuntu Lucid is in fact version 4.2.0, but it is not unusual to update rsyslog via a PPA do gain current features (we've been affected by this issue due to rsyslog version 5.6.3 installed from a PPA indeed).


On some versions, & ~ (with a space in between) doesn't work, but &~ (no space) does work. (After a restart of the service of course.)

On others still, stop might work instead. But it doesn't on Debian 7 / rsyslog 5.8.11.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .