I'm trying to use the RainerScript syntax in my Debian /etc/rsyslog.conf file. I want to log daemon stuff to a particular file, but only from pppd. Here's what I added:

if $programname == 'pppd' then {
    daemon.*;local2.*   -/var/log/pppd.log

I then restarted the rsyslog service. Stuff does get logged to this file; however I also get stuff from named so the if statement either seems to be being ignored, or always evaluating to true. Why would either of these be? Have I made a mistake in the code?

  • You have mixed syntax going on there. – Tim Nov 4 '13 at 21:12
  • How is it mixed syntax? Check out the RainerScript tutorial I linked to on the official rsyslog website; it says you can put the old syntax inside the new if clause syntax. – Jez Nov 4 '13 at 21:21
  • I believe I had tried the mixed syntax and it also failed for me in the past, I avoid it. – Tim Nov 4 '13 at 21:46


if $programname == 'pppd' and $syslogfacility-text =='daemon' and $syslogfacility-text == 'local2' then /var/log/pppd.log
if $programname == 'pppd' then ~

Line 1 says log to file /var/log/pppd.log

Line 2 says "OK stop logging to files", as in no further log files, the tilde actually means "discard".

  • But that's not quite doing what I want; it's not including the conditions that the facility be daemon or local2. – Jez Nov 4 '13 at 21:19
  • Updated the answer with conditionals for facility. Wasn't clear what you were trying to do with the syntax above. – Tim Nov 4 '13 at 21:45
  • OK so basically it simply seems the mixed syntax doesn't work, even though the documentation on the official rsyslog site says that it should. :-) – Jez Nov 5 '13 at 0:36
  • That's what I have experienced! – Tim Nov 6 '13 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.