Rsyslog filters on message contents and facility

loggingrsyslogsyslog

I have found examples of how to filter based on the contents of a log entry with rsyslog. But is there a way to do this so it is only filtering on the contents of a certain facility? For example something like:

if local0.* msg contains "foo"

But with a real syntax instead of what I just made up.

Best Answer

You'll need to do two sequential filters rather than both on one line.

:msg, contains, "some-text"
if $syslogfacility-text == "facility" then /var/log/somelog.log
~

Edit:

I take that back. I have seen it done both ways now. I just found this example in the rsyslog Wiki that should be able to be adapted.

if $programname == 'popa3d' and $syslogseverity <= '6' then /var/log/popa3d.log

You of course will substitute your conditions in to the example.

if $syslogfacility-text == 'local0' and $msg contains 'some-text' then /var/log/somelog.log
& ~

Rsyslog Wiki
Rsyslog Docs

Related Topic