rsyslog filter by tag

Question

I would like to create a rsyslogd config file that filter the syslog for specific tag and outputs this tag to a specific file.

I create a rule file under /etc/rsyslog.d

# Log kernel generated UFW log messages to file
:syslogtag, isequal, "ABC" /var/log/ABC.log

# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated UFW log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
#& ~

The file is created, however the messages with ABC tag still go to the syslog file. How do I do it correctly ?

Answer 1

Your rule file should look like:

:syslogtag, isequal, "ABC:" /var/log/ABC.log

The syslogtag contains a : and should be enclosed in "".

Also, the file name must be before 50-default.conf in alphabetical order (for example 30-ABC.conf).

Note that the file /var/log/ABC.log should be writable by the 'syslog' user.

Source: how to filer rsyslog messages by tags.