[rsyslog] exclude a program from syslog file

Discussion:

Xavier Saint-Claude via rsyslog

2018-11-15 16:37:55 UTC

Hi

i've created a rule like this (which can be improved i'm sure) :

if $programname == 'autofs' then /var/log/autofs.log
& stop
if $programname == 'automount' then /var/log/autofs.log
& stop

it's working fine, but i would like to also exclude it from logging to
/var/log/syslog (and others) because of previous rule i have up in the
conf (and i'm using debug log in autofs)

how does one achieve that ?

thanks in advance
Dann
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Rainer Gerhards

2018-11-15 17:03:53 UTC

Permalink

El jue., 15 nov. 2018 a las 17:38, Xavier Saint-Claude via rsyslog

Post by Xavier Saint-Claude via rsyslog
Hi
if $programname == 'autofs' then /var/log/autofs.log
& stop
if $programname == 'automount' then /var/log/autofs.log
& stop
it's working fine, but i would like to also exclude it from logging to
/var/log/syslog (and others) because of previous rule i have up in the
conf (and i'm using debug log in autofs)
how does one achieve that ?

move it up before the other rule

Rainer

Post by Xavier Saint-Claude via rsyslog
thanks in advance
Dann
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT

Xavier Saint-Claude via rsyslog

2018-11-15 17:13:59 UTC

Permalink

wow that was that simple ?
maybe that's the point of the & stop ? stopping those logs to go
anywhere else ? i seem to remember that in the old syntax (which i still
have in rsyslog.conf) it was not that easy...

thanks Rainer :)

Post by Rainer Gerhards
El jue., 15 nov. 2018 a las 17:38, Xavier Saint-Claude via rsyslog

move it up before the other rule
Rainer

Rainer Gerhards

2018-11-15 17:15:57 UTC

Permalink

El jue., 15 nov. 2018 a las 18:14, Xavier Saint-Claude

Post by Xavier Saint-Claude via rsyslog
wow that was that simple ?
maybe that's the point of the & stop ? stopping those logs to go anywhere else ? i seem to remember that in the old syntax (which i still have in rsyslog.conf) it was not that easy...

it's the same no matter which config type you use. rules are executed
from top to bottom and processing stop when you reach "stop" (or ~ in
very old style).

Rainer

Post by Xavier Saint-Claude via rsyslog
thanks Rainer :)
El jue., 15 nov. 2018 a las 17:38, Xavier Saint-Claude via rsyslog
Hi
if $programname == 'autofs' then /var/log/autofs.log
& stop
if $programname == 'automount' then /var/log/autofs.log
& stop
it's working fine, but i would like to also exclude it from logging to
/var/log/syslog (and others) because of previous rule i have up in the
conf (and i'm using debug log in autofs)
how does one achieve that ?
move it up before the other rule
Rainer
thanks in advance
Dann
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.