I would like to create a rsyslogd config file that filter the syslog for specific tag and outputs this tag to a specific file.

I create a rule file under /etc/rsyslog.d

# Log kernel generated UFW log messages to file
:syslogtag, isequal, "ABC" /var/log/ABC.log
# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated UFW log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
#& ~

The file is created, however the messages with ABC tag still go to the syslog file. How do I do it correctly ?

3

1 Answer

Your rule file should look like:

:syslogtag, isequal, "ABC:" /var/log/ABC.log

The syslogtag contains a : and should be enclosed in "".

Also, the file name must be before 50-default.conf in alphabetical order (for example 30-ABC.conf).

Note that the file /var/log/ABC.log should be writable by the 'syslog' user.

Source: how to filer rsyslog messages by tags.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy