Ubuntu – Removing ‘local7’ log entries from /var/log/messages

rsyslogUbuntu

Using rsyslog.conf on Ubuntu –

The default line for /var/log/messages in 50-default.conf is:

*.*;auth,authpriv.none      -/var/log/syslog

I'm starting to log a lot of things at the local7 level – with a line like:

local7.*   /my/file/name

All of the local7 messages are showing up in /var/log/syslog, which of course is not what I want. I can't quite nail the filter syntax to remove them…

Best Answer

Add local7.none after authpriv.none.

The important thing is that local7.none (which excludes local7) comes after *.* (which includes local7) on the /var/log/syslog line.

Related Solutions

Ubuntu – How to log iptables in Ubuntu just in /var/log/firewall with rsyslogd

Use a discard action after the iptables log, but before the other logs.

kern.warning   /var/log/firewall.log
kern.warning   ~
*.*            /var/log/messages

Remote rsyslog only writing logging data to /var/log/syslog and not custom logfiles

OK, solved it. I changed the config entry in my custom 22-remote.conf file in /etc/rsyslog.d/ from this:

:msg, contains, "AMAZONA-COMPUTERNAME1" /var/log/dbm/server-1.log
& ~
:msg, contains, "AMAZONA-COMPUTERNAME2" /var/log/dbm/server2.log
& ~

To this:

if $fromhost-ip == '10.11.12.12' then /var/log/dbm/server-1.log
& ~
if $fromhost-ip == '10.11.13.13' then /var/log/dbm/server2.log
& ~

Best Answer

Related Solutions

Ubuntu – How to log iptables in Ubuntu just in /var/log/firewall with rsyslogd

Remote rsyslog only writing logging data to /var/log/syslog and not custom logfiles

Related Topic