How to discard particular Severity's in the Rsyslog Server
Clash Royale CLAN TAG#URR8PPP
I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be accepted.
I have below config which partially shows template and Rules to be checked.
In the below config I have commented the all the Custom conditional Forwarding because I have other hostnames starts with different names. So, I'm thinking about the way if I can only discard warn , info and debug and rest to come.
$template wcc-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
#### RULES ############################################
# Log anything (except mail) of level info or higher.#
# Don't log private authentication messages! #
####################################################
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
#if $fromhost startswith "wc" then
# *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
# & stop
#
#if $fromhost startswith "sj" then -?wcc-logs
#& stop
#if $fromhost startswith "vlsj-" then -?wcc-logs
#& stop
In the above configuration you may see I'm using the below Rules in the RULES section assuming that everything should be logged except the First line:
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
rsyslogd 8.24.0
linux rsyslog
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
asked Feb 15 at 15:32
pygopygo
957
add a comment |
I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be accepted.
I have below config which partially shows template and Rules to be checked.
In the below config I have commented the all the Custom conditional Forwarding because I have other hostnames starts with different names. So, I'm thinking about the way if I can only discard warn , info and debug and rest to come.
$template wcc-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
#### RULES ############################################
# Log anything (except mail) of level info or higher.#
# Don't log private authentication messages! #
####################################################
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
#if $fromhost startswith "wc" then
# *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
# & stop
#
#if $fromhost startswith "sj" then -?wcc-logs
#& stop
#if $fromhost startswith "vlsj-" then -?wcc-logs
#& stop
In the above configuration you may see I'm using the below Rules in the RULES section assuming that everything should be logged except the First line:
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
rsyslogd 8.24.0
linux rsyslog
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
asked Feb 15 at 15:32
pygopygo
957
Just to be clear, you want to discard every log message at the warn, info and debug levels. Is that correct?
– Haxiel
Feb 15 at 16:11
@Haxiel, yes, if there was another cases where partial exclusion may happen that would be interesting to see as well.
– pygo
Feb 15 at 16:41
add a comment |
I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be accepted.
I have below config which partially shows template and Rules to be checked.
In the below config I have commented the all the Custom conditional Forwarding because I have other hostnames starts with different names. So, I'm thinking about the way if I can only discard warn , info and debug and rest to come.
$template wcc-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
#### RULES ############################################
# Log anything (except mail) of level info or higher.#
# Don't log private authentication messages! #
####################################################
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
#if $fromhost startswith "wc" then
# *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
# & stop
#
#if $fromhost startswith "sj" then -?wcc-logs
#& stop
#if $fromhost startswith "vlsj-" then -?wcc-logs
#& stop
In the above configuration you may see I'm using the below Rules in the RULES section assuming that everything should be logged except the First line:
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
rsyslogd 8.24.0
linux rsyslog
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
asked Feb 15 at 15:32
pygopygo
957
I have an rsyslog server that's having the data from multiple remote clients; now I want to discard particular Severity types like warn , info and debug and the rest of the messages I want to be accepted.
I have below config which partially shows template and Rules to be checked.
In the below config I have commented the all the Custom conditional Forwarding because I have other hostnames starts with different names. So, I'm thinking about the way if I can only discard warn , info and debug and rest to come.
$template wcc-logs, "/data/SYSTEMS/%HOSTNAME%/messages.log"
#### RULES ############################################
# Log anything (except mail) of level info or higher.#
# Don't log private authentication messages! #
####################################################
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
#####################################################################
# Custom conditional Forwarding of messages to the syslog Directory #
###################################################################
#if $fromhost startswith "wc" then
# *.crit,*.err,*.emerg,*.alert,*.panic,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
# & stop
#
#if $fromhost startswith "sj" then -?wcc-logs
#& stop
#if $fromhost startswith "vlsj-" then -?wcc-logs
#& stop
In the above configuration you may see I'm using the below Rules in the RULES section assuming that everything should be logged except the First line:
mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
*.* ?wcc-logs
rsyslogd 8.24.0
linux rsyslog
linux rsyslog
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
asked Feb 15 at 15:32
pygopygo
957
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
asked Feb 15 at 15:32
pygopygo
957
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
edited Feb 17 at 13:42
Jeff Schaller
43.3k1159139
43.3k1159139
asked Feb 15 at 15:32
pygopygo
957
asked Feb 15 at 15:32
pygopygo
957
asked Feb 15 at 15:32
pygopygo
957
957
Just to be clear, you want to discard every log message at the warn, info and debug levels. Is that correct?
– Haxiel
Feb 15 at 16:11
@Haxiel, yes, if there was another cases where partial exclusion may happen that would be interesting to see as well.
– pygo
Feb 15 at 16:41
add a comment |
Just to be clear, you want to discard every log message at the warn, info and debug levels. Is that correct?
– Haxiel
Feb 15 at 16:11
@Haxiel, yes, if there was another cases where partial exclusion may happen that would be interesting to see as well.
– pygo
Feb 15 at 16:41
Just to be clear, you want to discard every log message at the warn, info and debug levels. Is that correct?
– Haxiel
Feb 15 at 16:11
Just to be clear, you want to discard every log message at the warn, info and debug levels. Is that correct?
– Haxiel
Feb 15 at 16:11
@Haxiel, yes, if there was another cases where partial exclusion may happen that would be interesting to see as well.
– pygo
Feb 15 at 16:41
@Haxiel, yes, if there was another cases where partial exclusion may happen that would be interesting to see as well.
– pygo
Feb 15 at 16:41
add a comment |
1 Answer
1
active
oldest
votes
You can use the following syntax to drop all messages at the warn, info and debug levels and everything else to be logged using the 'wcc-logs' template:
*.=warn,*.=info,*.=debug stop
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
The dropped messages will not be available for further processing to any of the following rules in the rsyslog.conf file.
If you want to omit the messages at these levels, but still have them available for further processing for other rules down the line, you can extend the single rule to ignore these specific levels:
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none,*.!=warn,*.!=info,*.!=debug ?wcc-logs
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
– pygo
Feb 15 at 16:48
I can even use like*.*,!=info,*.!=debug ?wcc-logs?
– pygo
Feb 15 at 16:56
@pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use*.notice ?wcc-logsinstead.
– Haxiel
Feb 15 at 17:08
you mean just to use*.notice ?wcc-logsrather*.*,!=info,*.!=debug ?wcc-logsbuy i needwarnalso excluded ..
– pygo
Feb 15 at 17:16
Sorry for asking too much , i beleive i need all these excluded like you given example*.=notice,*.=warn,*.=info,*.=debug stopi don't even want notice
– pygo
Feb 15 at 17:20
|
show 2 more comments
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f500899%2fhow-to-discard-particular-severitys-in-the-rsyslog-server%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can use the following syntax to drop all messages at the warn, info and debug levels and everything else to be logged using the 'wcc-logs' template:
*.=warn,*.=info,*.=debug stop
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
The dropped messages will not be available for further processing to any of the following rules in the rsyslog.conf file.
If you want to omit the messages at these levels, but still have them available for further processing for other rules down the line, you can extend the single rule to ignore these specific levels:
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none,*.!=warn,*.!=info,*.!=debug ?wcc-logs
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
– pygo
Feb 15 at 16:48
I can even use like*.*,!=info,*.!=debug ?wcc-logs?
– pygo
Feb 15 at 16:56
@pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use*.notice ?wcc-logsinstead.
– Haxiel
Feb 15 at 17:08
you mean just to use*.notice ?wcc-logsrather*.*,!=info,*.!=debug ?wcc-logsbuy i needwarnalso excluded ..
– pygo
Feb 15 at 17:16
Sorry for asking too much , i beleive i need all these excluded like you given example*.=notice,*.=warn,*.=info,*.=debug stopi don't even want notice
– pygo
Feb 15 at 17:20
|
show 2 more comments
You can use the following syntax to drop all messages at the warn, info and debug levels and everything else to be logged using the 'wcc-logs' template:
*.=warn,*.=info,*.=debug stop
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
The dropped messages will not be available for further processing to any of the following rules in the rsyslog.conf file.
If you want to omit the messages at these levels, but still have them available for further processing for other rules down the line, you can extend the single rule to ignore these specific levels:
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none,*.!=warn,*.!=info,*.!=debug ?wcc-logs
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
– pygo
Feb 15 at 16:48
I can even use like*.*,!=info,*.!=debug ?wcc-logs?
– pygo
Feb 15 at 16:56
@pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use*.notice ?wcc-logsinstead.
– Haxiel
Feb 15 at 17:08
you mean just to use*.notice ?wcc-logsrather*.*,!=info,*.!=debug ?wcc-logsbuy i needwarnalso excluded ..
– pygo
Feb 15 at 17:16
Sorry for asking too much , i beleive i need all these excluded like you given example*.=notice,*.=warn,*.=info,*.=debug stopi don't even want notice
– pygo
Feb 15 at 17:20
|
show 2 more comments
You can use the following syntax to drop all messages at the warn, info and debug levels and everything else to be logged using the 'wcc-logs' template:
*.=warn,*.=info,*.=debug stop
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
The dropped messages will not be available for further processing to any of the following rules in the rsyslog.conf file.
If you want to omit the messages at these levels, but still have them available for further processing for other rules down the line, you can extend the single rule to ignore these specific levels:
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none,*.!=warn,*.!=info,*.!=debug ?wcc-logs
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
You can use the following syntax to drop all messages at the warn, info and debug levels and everything else to be logged using the 'wcc-logs' template:
*.=warn,*.=info,*.=debug stop
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none ?wcc-logs
The dropped messages will not be available for further processing to any of the following rules in the rsyslog.conf file.
If you want to omit the messages at these levels, but still have them available for further processing for other rules down the line, you can extend the single rule to ignore these specific levels:
*.*,mail.none,authpriv.none,cron.none,news.none,uucp.none,kern.none,*.!=warn,*.!=info,*.!=debug ?wcc-logs
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
answered Feb 15 at 16:42
HaxielHaxiel
3,1501919
3,1501919
Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
– pygo
Feb 15 at 16:48
I can even use like*.*,!=info,*.!=debug ?wcc-logs?
– pygo
Feb 15 at 16:56
@pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use*.notice ?wcc-logsinstead.
– Haxiel
Feb 15 at 17:08
you mean just to use*.notice ?wcc-logsrather*.*,!=info,*.!=debug ?wcc-logsbuy i needwarnalso excluded ..
– pygo
Feb 15 at 17:16
Sorry for asking too much , i beleive i need all these excluded like you given example*.=notice,*.=warn,*.=info,*.=debug stopi don't even want notice
– pygo
Feb 15 at 17:20
|
show 2 more comments
Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
– pygo
Feb 15 at 16:48
I can even use like*.*,!=info,*.!=debug ?wcc-logs?
– pygo
Feb 15 at 16:56
@pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use*.notice ?wcc-logsinstead.
– Haxiel
Feb 15 at 17:08
you mean just to use*.notice ?wcc-logsrather*.*,!=info,*.!=debug ?wcc-logsbuy i needwarnalso excluded ..
– pygo
Feb 15 at 17:16
Sorry for asking too much , i beleive i need all these excluded like you given example*.=notice,*.=warn,*.=info,*.=debug stopi don't even want notice
– pygo
Feb 15 at 17:20
Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
– pygo
Feb 15 at 16:48
Thanks @Haxiel , its interesting to see the logic thanks a mile, let me try these, already +1
– pygo
Feb 15 at 16:48
I can even use like
*.*,!=info,*.!=debug ?wcc-logs ?– pygo
Feb 15 at 16:56
I can even use like
*.*,!=info,*.!=debug ?wcc-logs ?– pygo
Feb 15 at 16:56
@pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use
*.notice ?wcc-logs instead.– Haxiel
Feb 15 at 17:08
@pygo If you want to omit the logs at the info and debug levels (which are the lowest two levels), it's better to just flip the logic and use
*.notice ?wcc-logs instead.– Haxiel
Feb 15 at 17:08
you mean just to use
*.notice ?wcc-logs rather *.*,!=info,*.!=debug ?wcc-logs buy i need warn also excluded ..– pygo
Feb 15 at 17:16
you mean just to use
*.notice ?wcc-logs rather *.*,!=info,*.!=debug ?wcc-logs buy i need warn also excluded ..– pygo
Feb 15 at 17:16
Sorry for asking too much , i beleive i need all these excluded like you given example
*.=notice,*.=warn,*.=info,*.=debug stop i don't even want notice– pygo
Feb 15 at 17:20
Sorry for asking too much , i beleive i need all these excluded like you given example
*.=notice,*.=warn,*.=info,*.=debug stop i don't even want notice– pygo
Feb 15 at 17:20
|
show 2 more comments
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f500899%2fhow-to-discard-particular-severitys-in-the-rsyslog-server%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Just to be clear, you want to discard every log message at the warn, info and debug levels. Is that correct?
– Haxiel
Feb 15 at 16:11
@Haxiel, yes, if there was another cases where partial exclusion may happen that would be interesting to see as well.
– pygo
Feb 15 at 16:41