I would like to create a rsyslogd config file that filter the syslog for specific tag and outputs this tag to a specific file.

I create a rule file under /etc/rsyslog.d

# Log kernel generated UFW log messages to file
:syslogtag, isequal, "ABC" /var/log/ABC.log

# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated UFW log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
#& ~

The file is created, however the messages with ABC tag still go to the syslog file. How do I do it correctly ?

  • 1
    Make sure that your /etc/rsyslog.conf contains > $IncludeConfig /etc/rsyslog.d/* If not add it, without it the service will not read the config added to the /etc/rsyslog.d/ folder. If that is present then try adding the rule directly to your rsyslog.conf file. – Bruno Pereira Jul 11 '13 at 9:07
  • it already contains it. I think that I have an issue with the rule I declared, not the non-inclusion of it. (the file is created) – Mellowcandle Jul 11 '13 at 10:42
  • True, you are right about that. – Bruno Pereira Jul 11 '13 at 10:50

Your rule file should look like:

:syslogtag, isequal, "ABC:" /var/log/ABC.log

The syslogtag contains a : and should be enclosed in "".

Also, the file name must be before 50-default.conf in alphabetical order (for example 30-ABC.conf).

Note that the file /var/log/ABC.log should be writable by the 'syslog' user.

Source: how to filer rsyslog messages by tags.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.