rsyslog continues to process messages through your entire ruleset until they are discarded, not until they match a single rule. This allows you to fork multiple copies of the message to multiple destinations if you want, using catchall rules, etc.
If you want it to stop processing it after it matches a rule, you need to discard it after you've processed it. -- Gary F. On Mar 14, 2013, at 5:47 PM, Chad Gowin <[email protected]> wrote: > Hey rsyslog-users, > > Using rsyslog 5.8.10, I'm using the imfile module to monitor my apache logs > and send them to a remote server: > > $InputFileName /var/log/httpd/www.vhost.com-access.log > $InputFileTag httpd > $InputFileStateFile www.vhost.com-access.state > $InputFileSeverity notice > $InputFileFacility local2 > $InputRunFileMonitor > $InputFilePersistStateInterval 1000 > > and logs are being shipped off with this line: > > kern.*;*.info;authpriv.*;cron.*;*.emerg;local1.*;local2.* @@remote:514 > > On the remote server, I have rules for these messages, as well as a rule to > recreate what goes into the /var/log/messages on the local host: > > if $programname == 'httpd' and $syslogseverity-text == 'notice' then > -?httpd-access;RSYSLOG_FileFormat > > kern.*;*.info;*.emerg;cron.none -?syslog;RSYSLOG_FileFormat > > My httpd logs are reaching their proper destination, but they're also going > into the syslog file. I find this strange, since what I've defined for > syslog doesn't match my httpd messages. I've tried using discards to get > rid of the messages before they reach syslog, but this didn't have an > effect either. Might anyone be able to say why these messages are ending up > where they are? > > Thanks, > Chad > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
