Search code examples
clinuxubuntu-serverrsyslog

Filter rsyslogd messages

I have a daemon that generates 15 - 20GB of logging each day. I want to use syslog (rsyslogd) to log all the messages. It is possible to redirect these messages to a file and not be printed /var/log/syslog?

I created a rule in /etc/rsyslogd/50-myprogram.conf that contains:

!MYPROGRAM
*.*     /var/local/myprogram/myprogram.log
!*

Now every message appears twice, in /var/local/myprogram/myprogram.log and in /var/log/syslog. How can this be solved?

Solution

  • I managed to do this with:

    if $programname == 'MYPROGRAM' then /var/local/myprogram/myprogram.log
& ~

    The important thing here is: & ~, that discards the messages matched by the previous line.