Hello, Thank you for the resolution, is there anyway I can specify just one rule for doing this? The thing is I have more than 50 lines specifying ":programname, isequal, .." so I would like to know if there is other better solution rather than adding "& ~" below every line. I tried adding "& ~" at the very botton but it didnt work.
Many thanks. --- On Fri, 12/11/09, Rainer Gerhards <[email protected]> wrote: > From: Rainer Gerhards <[email protected]> > Subject: Re: [rsyslog] filter logger tags from syslog > To: "rsyslog-users" <[email protected]> > Date: Friday, December 11, 2009, 9:54 AM > See this, especially "splitting local > and remote logging" (especially the > traditional approach) > > http://www.rsyslog.com/doc-multi_ruleset.html > > Rainer > > > -----Original Message----- > > From: [email protected] > [mailto:rsyslog- > > [email protected]] > On Behalf Of Jose Sanchez > > Sent: Friday, December 11, 2009 4:41 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] filter logger tags from syslog > > > > Hello again, > > > > Everything is running pretty smooth after the solution > applied, I have > > noted just one thing, my /var/log/messages is > caughting all the logs > > (including the statistics log from apache) on each > server and due this > > the file goes up to 5-6GB every few days, is there > anyway to prevent > > the apache statistics to go to this log file? > > > > This is my syslog.conf > > > > ------------- > > # Log all kernel messages to the console. > > # Logging much else clutters up the screen. > > #kern.* > > /dev/console > > > > # Log anything (except mail) of level info or higher. > > # Don't log private authentication messages! > > > *.info;mail.none;authpriv.none;cron.none > /var/log/messages > > > > # The authpriv file has restricted access. > > authpriv.* > > /var/log/secure > > > > # Log all the mail messages in one place. > > mail.* > -/var/log/maillog > > > > > > # Log cron stuff > > cron.* > > /var/log/cron > > > > # Everybody gets emergency messages > > *.emerg > > * > > > > # Save news errors of level crit and higher in a > special file. > > uucp,news.crit > /var/log/spooler > > > > # Save boot messages also to boot.log > > local7.* > > /var/log/boot.log > > > > local1.* @rsyslog-server.domain.com > > ------------- > > > > Thank you in advance. > > > > > > --- On Sat, 11/28/09, [email protected] <[email protected]> > wrote: > > > > > From: [email protected] <[email protected]> > > > Subject: Re: [rsyslog] filter logger tags from > syslog > > > To: "rsyslog-users" <[email protected]> > > > Date: Saturday, November 28, 2009, 3:43 AM > > > On Fri, 27 Nov 2009, Jose Sanchez > > > wrote: > > > > > > > Hello David and Reiner, > > > > > > > > First I would like to thank you for all the > help > > > offered, I was able to setup almost everything > because of > > > you guys. > > > > > > > > I had some issues today, though. I found > that rsyslog > > > was removing the "logger" properly but it was > adding an > > > extra empty space not sure why so I had to cut if > off (by > > > watching how to do it on video tutorial first!) > by modifying > > > the template that David gave me, I currently have > it like > > > this, > > > > > > > > $template line,"%msg:2:1000%\n" > > > > > > > > The thing here is Im not sure if this is a > reliable > > > solution, I couldnt find if there is any setting > that will > > > tell rsyslog to simply remove the empty space or > to get > > > everything until the last letter so I configured > a very long > > > (1000) number in case rsyslog cuts some part of > the text. > > > Not sure if there is any negative impact on doing > it this > > > way, if there is any other better way, please let > me know. > > > > > > if you use '$' instead of '1000' it will go to > the end of > > > the message, no > > > matter how long it is (1000 is not long enough > for some > > > messages) > > > > > > I think that what you are doing is probably the > best way to > > > deal with > > > this space. > > > > > > David Lang > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
