On Wed, Dec 18, 2019 at 16:28:11 -0500, David H. Durgee via rsyslog wrote:
> I have added a file acpupsdlog.conf to my /etc/rsyslog.d directory to
> handle the logging, but am encountering unexpected results.
> As per apcupsd recommendation their log data has a facility setting of
(Can you give a pointer to the exact instructions you were following?)
> local0. Their example file was for syslog so I had to adapt it
> slightly. The contents of my file are:
>
> # attempt to get apcupsd logging working properly
> #
> # exclude all apcupsd info by default
> *.info;local0.none /var/log/syslog
>
> # Everything for apcupsd goes here
> local0.info;local0.!notice /var/log/apcupsd.data
> local0.notice;local0.!warn |/var/log/apcupsd.status
> local0.warn /var/log/apcupsd.events
A big difference between old-style syslog and modern rsyslog is that the
former used a monolithic config file but rsyslog (and rsyslog under
Ubuntu in particular) uses multiple config-file snippets.
In this case it looks like the example file in your instructions was
intented to be the entire configuration file (following the syslog
style)... but for a modern Ubuntu-based system, the file you create
should instead be limited to dealing with just to apcupsd messages (see
below).
> This does appear to get the apcupsd logging to the /var/log/apcupsd.* as
> expected, but I am also seeing the logging that goes to the
> /var/log/apcupsd.data file in the /var/log/syslog file. As per the
> comments above the first functional line, I had expected none of the
> apcupsd logging to be included in the /var/log/syslog file. Is there a
> problem with the line? Is there an edge condition that got missed?
Actually, are all non-apcupsd messages are now appearing in the
/var/log/syslog file twice? I would expect so. once from the line
above, and once from the
*.*;auth,authpriv.none -/var/log/syslog
line in the 50-default.conf file....
In any case, I think the following hints should get you closer to what
you want:
* name your new file with a 2-digit numeric prefix, something like
"30-acpupsdlog.conf", for consistency with Ubuntu-package-supplied
rsyslog.d/ files
* remove the syslog line from your config file (thus allowing the
default line in 50-default.conf to control logging to that log file)
* By design the default configuration puts (essentially) all messages
/in var/log/syslog, even messages that also go into other log files
(most notably in Xenial, messages that go into mail.log also go into
syslog).
But as David mention, if you want to exclude the apcupsd messages
from syslog then you can use a
local0.* stop
line at the bottom of your config file to prevent those messages from
being processeed by later config directives.
(For this to work you must be sure the order of the config files is
correct -- that's why Ubuntu uses the sequence-number prefixes on
the config files, and why I suggested "30-" as the prefix in your
case, to make sure it sorts before "50-default.conf".)
Nathan
----------------------------------------------------------------------------
Nathan Stratton Treadway - [email protected] - Mid-Atlantic region
Ray Ontko & Co. - Software consulting services - http://www.ontko.com/
GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239
Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
