See this, especially "splitting local and remote logging" (especially the traditional approach)
http://www.rsyslog.com/doc-multi_ruleset.html Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Jose Sanchez > Sent: Friday, December 11, 2009 4:41 PM > To: rsyslog-users > Subject: Re: [rsyslog] filter logger tags from syslog > > Hello again, > > Everything is running pretty smooth after the solution applied, I have > noted just one thing, my /var/log/messages is caughting all the logs > (including the statistics log from apache) on each server and due this > the file goes up to 5-6GB every few days, is there anyway to prevent > the apache statistics to go to this log file? > > This is my syslog.conf > > ------------- > # Log all kernel messages to the console. > # Logging much else clutters up the screen. > #kern.* /dev/console > > # Log anything (except mail) of level info or higher. > # Don't log private authentication messages! > *.info;mail.none;authpriv.none;cron.none /var/log/messages > > # The authpriv file has restricted access. > authpriv.* /var/log/secure > > # Log all the mail messages in one place. > mail.* -/var/log/maillog > > > # Log cron stuff > cron.* /var/log/cron > > # Everybody gets emergency messages > *.emerg * > > # Save news errors of level crit and higher in a special file. > uucp,news.crit /var/log/spooler > > # Save boot messages also to boot.log > local7.* /var/log/boot.log > > local1.* @rsyslog-server.domain.com > ------------- > > Thank you in advance. > > > --- On Sat, 11/28/09, [email protected] <[email protected]> wrote: > > > From: [email protected] <[email protected]> > > Subject: Re: [rsyslog] filter logger tags from syslog > > To: "rsyslog-users" <[email protected]> > > Date: Saturday, November 28, 2009, 3:43 AM > > On Fri, 27 Nov 2009, Jose Sanchez > > wrote: > > > > > Hello David and Reiner, > > > > > > First I would like to thank you for all the help > > offered, I was able to setup almost everything because of > > you guys. > > > > > > I had some issues today, though. I found that rsyslog > > was removing the "logger" properly but it was adding an > > extra empty space not sure why so I had to cut if off (by > > watching how to do it on video tutorial first!) by modifying > > the template that David gave me, I currently have it like > > this, > > > > > > $template line,"%msg:2:1000%\n" > > > > > > The thing here is Im not sure if this is a reliable > > solution, I couldnt find if there is any setting that will > > tell rsyslog to simply remove the empty space or to get > > everything until the last letter so I configured a very long > > (1000) number in case rsyslog cuts some part of the text. > > Not sure if there is any negative impact on doing it this > > way, if there is any other better way, please let me know. > > > > if you use '$' instead of '1000' it will go to the end of > > the message, no > > matter how long it is (1000 is not long enough for some > > messages) > > > > I think that what you are doing is probably the best way to > > deal with > > this space. > > > > David Lang > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
