I guess the answer is simply that your file is included at the wrong spot into the main config file. Move that code to the top of the main file and it will work. Position-dependent rules like this and including via a directory does not work well together.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Tim Uckun > Sent: Friday, October 22, 2010 12:36 PM > To: rsyslog-users > Subject: Re: [rsyslog] postgres logging to three places.. > > On Thu, Oct 21, 2010 at 6:26 PM, Rainer Gerhards > <[email protected]> wrote: > > do > > > > local0.* -/var/log/postgresql/postgresql-8.4-main.log > > & ~ > > > > I am afraid this did not work. > > To give you more details. > > I am running on ubuntu with postgres 8.4. Postgres is configured like > this. > > log_destination = 'syslog' > syslog_facility = 'LOCAL0' > > I created a file called postgresql.conf in the /etc/rsyslog.d/ > directory and now it looks like this. > > local0.* -/var/log/postgresql/postgresql-8.4-main.log > & ~ > > # > # add local0 to the ignore field for the normal messages so it wont' > get logged twice. > # > > *.=info;*.=notice;*.=warn;\ > local0.none -/var/log/messages > *.=info;*.=notice;*.=warn;\ > local0.none -/var/log/syslog > > > > I tried it with and without the bottom part (after the comments). > > No matter what I do every entry is written into /var/log/messages , > /var/log/syslog and /var/log/postgresql/postgresql-8.4-main.log > > I am reloading rsyslog with "reload rsyslog" when I do that both > syslog and messages have rsyslog messages on them which is also a bit > puzzling. > > The rest of the syslog configuration is in 50-default.conf which I > didn't touch but I have included here for reference. > > > > Default rules for rsyslog. > # > # For more information see rsyslog.conf(5) and > /etc/rsyslog.conf > > # > # First some standard log files. Log by facility. > # > auth,authpriv.* /var/log/auth.log > *.*;auth,authpriv.none -/var/log/syslog > #cron.* /var/log/cron.log > daemon.* -/var/log/daemon.log > kern.* -/var/log/kern.log > lpr.* -/var/log/lpr.log > mail.* -/var/log/mail.log > user.* -/var/log/user.log > > # > # Logging for the mail system. Split it up so that > # it is easy to write scripts to parse these files. > # > mail.info -/var/log/mail.info > mail.warn -/var/log/mail.warn > mail.err /var/log/mail.err > > # > # Logging for INN news system. > # > news.crit /var/log/news/news.crit > news.err /var/log/news/news.err > news.notice -/var/log/news/news.notice > > # > # Some "catch-all" log files. > # > *.=debug;\ > auth,authpriv.none;\ > news.none;mail.none -/var/log/debug > *.=info;*.=notice;*.=warn;\ > auth,authpriv.none;\ > cron,daemon.none;\ > mail,news.none -/var/log/messages > > # > # Emergencies are sent to everybody logged in. > # > *.emerg * > > # > # I like to have messages displayed on the console, but only on a > virtual > # console I usually leave idle. > # > #daemon,mail.*;\ > # news.=crit;news.=err;news.=notice;\ > # *.=debug;*.=info;\ > # *.=notice;*.=warn /dev/tty8 > > # The named pipe /dev/xconsole is for the `xconsole' utility. To use > it, > # you must invoke `xconsole' with the `-file' option: > # > # $ xconsole -file /dev/xconsole [...] > # > # NOTE: adjust the list below, or you'll go crazy if you have a > reasonably > # busy site.. > # > daemon.*;mail.*;\ > news.err;\ > *.=debug;*.=info;\ > *.=notice;*.=warn |/dev/xconsole > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
