syslog matches all filters unless you have a filter that says 'stop' (or ~ in
the obsolete format) as the action.
That comment only applied to that one line, or the author was mistaken
if you want to have rsyslog throw away a message, do something like
loacl0.* stop
and nothing after it in the file will process that messages
make sure this is before your include.
David Lang
P.S. the 50-default was created by your distro.
On Wed, 18 Dec 2019, David H. Durgee wrote:
Date: Wed, 18 Dec 2019 17:26:04 -0500
From: David H. Durgee <[email protected]>
To: David Lang <[email protected]>,
David H. Durgee via rsyslog <[email protected]>
Subject: Re: [rsyslog] unexpected results with rsyslog
David Lang wrote:
why would you expect the logs to not go into /var/log/syslog?
don't the messages match the filter you have defined for that?
do you have any filters that you don't show us that would throw away
the log before you get to that line?
the logs get written to every line where the filters match, not just
the first one.
David Lang
I can't say that I am totally familiar with the rsyslog or its filters,
so I am relying upon the original author of the .conf file. I read his
comment "# exclude all apcupsd info by default" above the filter as
defining its intent, and knowing that apcupsd is using local0 only I
interpreted "local0.none" as indicating that nothing from local0 would
go to /var/log/syslog. If this is not what the filter is doing then it
needs to be corrected to do so.
The other filters on the system are those in
/etc/rsyslog.d/50-default.conf as installed on my distro. I am unsure
if that was part of your package or if ubuntu created it. Let me know
if you would need to see it.
Dave
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
