Rsyslog is not discarding message as it should

logsrsyslogsyslog

I have set up rsyslog to write messages from local0.* to a separate logfile, and then discard the messages. For some reason, the logs are going to both /var/log/syslog, and the new logfile.

I have put the config in rsyslog.d/30-local0.conf, which as far as I know, should come before the 50-default.conf, and so the message should be discarded before hitting the standard rules and being written to syslog?

Best Answer

Sounds correct so far, we may need more data (your actual config files).

Just to be sure, you should have this in 30-local0.conf:

local0.* /var/log/local0.log
       & ~

Related Solutions

Rsyslog rule inconsistently applied

From the output you've given it looks like the python script is not sending all the pieces of the syslog message that rsyslog is expecting. It appears as if the "{FILTER}" part is where the host and app name should be. You can pretty easily prove this by running rsyslogd with the -d flag then sending the message from python and then from logger. You'll see the raw message as it comes from the socket that way and I bet you'll see that logger is sending more fields in front of the "{FILTER}" part.

Ubuntu – Rsyslog not creating log files

Create /dev/xconsole and set its correct ownership and permissions:

sudo touch /dev/xconsole
sudo chgrp syslog /dev/xconsole
sudo chmod 664 /dev/xconsole

Restart the rsyslog service as follows:

Ubuntu 14.04

sudo service rsyslog restart

Ubuntu 16.04 and later, using systemd

sudo systemctl restart rsyslog

Verify the error message no longer appears:

tail -n100 /var/log/syslog | grep rsyslog

Best Answer

Related Solutions

Rsyslog rule inconsistently applied

Ubuntu – Rsyslog not creating log files

Related Question