Search code examples
linuxrsyslog

Difference between :omusrmsg:* and * action in rsyslog.conf

I have seen both * and :omusrmsg:* used as actions in rsyslog.conf files like for example in:

*.emerg                                                 :omusrmsg:*n

or

*.emerg                                                 *

Both of which should send emergency messages to all logged-in users.

So what exactly is the difference between these two actions and why should I prefer one over the other?

Solution

  • You're correct. Both lines do the exact same thing. They both log emergency messages, but the second line using the * action to send messages to all users is deprecated since rsyslog v7 (See: omusrmsg: using just a username or “*” is deprecated).

    In legacy config format, the asterisk denotes writing the message to all users. This is usually used for emergency messages and configured like this:

    *.emerg  *

    Unfortunately, the use of this single character conflicts with other uses, for example with the multiplication operator. While rsyslog up to versions v7.4 preserves the meaning of asterisk as an action, it is deprecated and will probably be removed in future versions. Consequently, a warning message is emitted. To make this warning go away, the action must be explicitly given, as follows:

    *.emerg  :omusrmsg:*

    Therefore it is recommended to use *.emerg :omusrmsg:* or for even more clarity the new RainerScript style of action can also be used:

    *.emerg  action(type="omusrmsg" users="*")