Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a program which outputs to syslog with a given tag/program name. I'd like to be able to filter syslog traffic from that program and send it to a remote syslog server, leaving all other syslog traffic local.

I can send all traffic to the remote server with

*.* @remote_server

How do I filter it?

share|improve this question
    
This answered my question. stackoverflow.com/questions/4042115/ruby-syslog-custom-facility –  Simmo Sep 11 '12 at 15:39
add comment

1 Answer

up vote 7 down vote accepted

Rsyslog config files are located in: /etc/rsyslog.d/*.conf

Rsyslog reads the conf files sequently, so it is important that you name your config file so that the specific config is loaded before anything else happens. So, name your file starting with leading zero's, i.e. 00-my-file.conf (It's better to create a new file so that updates and so on doesn't overwrite your local config).

Example:

if $programname == 'programname' and $msg contains 'a text string' and $syslogseverity <= '6' then /var/log/custom/bind.log

Or if you just want to discard certain entries:

if $programname == 'programname' then ~

In your case: (UDP)

if $programname == 'programname' then @remote.syslog.server
& ~

Or (TCP)

if $programname == 'programname' then @@remote.syslog.server
& ~

The & ~ means to stop processing matching (previous line only!) entries further.

Some more general info:

Also, always make sure filters are on the same line:

# Example: Log mail server control messages to mail-queue.log
if $hostname == 'titus'\
and $programname == 'smtp.queue.'\
and $syslogseverity <= '6' then /var/log/titus/mail-queue.log
& ~

Usefull filters:

$hostname
$programname
$msg
$syslogseverity

Operators:

== (equals)
contains
and
or

More info: http://wiki.rsyslog.com/index.php/Configuration_Samples

BR,

Oblivian

share|improve this answer
    
Thank you for your link. –  shgnInc Dec 22 '13 at 8:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.