I tried a solution, disabling kern.debug with : ``` kern.debug stop kern.* -/var/log/kern.log ```
This turned the log from 1000 lines to 150 after a reboot. Just to confirm, is this the correct way ? Does the kern.* still produces logs except for kern.debug ? Regards, October 12, 2020 11:05 AM, "Rainer Gerhards" <[email protected]> wrote: > if you know how to filter at graylog, you can also filter out and > discard those messages at rsyslog ;-) > > Rainer > > El lun., 12 oct. 2020 a las 10:40, Unam via rsyslog > (<[email protected]>) escribió: > >> Yep, I can filter directly into graylog but the reboot of 150 servers >> generate thousand of lines >> into graylog. >> >> I would like to avoid consuming bandwidth and storage on my graylog server >> instead of filter on it. >> >> October 12, 2020 10:32 AM, "Rainer Gerhards" <[email protected]> >> wrote: >> >> just an idea: could you filter out certain strings? >> >> Rainer >> >> El lun., 12 oct. 2020 a las 10:00, Unam via rsyslog >> (<[email protected]>) escribió: >> >> Hi there, >> >> I am using rsyslog to send all our logs on a remote graylog server. The >> config on every host >> (Debian 9 & 10) is quite simple, we send by default everything. >> All our servers are rebooted every night and we receive tons of logs that we >> don't care about. >> >> My question is maybe very simple but, is there an option in rsyslog to >> filters this logs and don't >> send them to the remote ? >> >> I searched in the doc but nothing seems to talk about boot sequence. I >> already tried to edit >> grub.cfg to make the boot process silent without success. >> >> Thanks for your hints. >> >> Regards, >> _______________________________________________ >> rsyslog mailing list >> https://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> https://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
