> I tried a solution, disabling kern.debug with : > > ``` > kern.debug stop > kern.* -/var/log/kern.log > ``` > > This turned the log from 1000 lines to 150 after a reboot. > > Just to confirm, is this the correct way ? Does the kern.* still produces > logs except for kern.debug ?
yes As I said, you can also filter out based on some e.g. string inside the message. Just so that you know. Rainer > > Regards, > > October 12, 2020 11:05 AM, "Rainer Gerhards" <[email protected]> wrote: > > > if you know how to filter at graylog, you can also filter out and > > discard those messages at rsyslog ;-) > > > > Rainer > > > > El lun., 12 oct. 2020 a las 10:40, Unam via rsyslog > > (<[email protected]>) escribió: > > > >> Yep, I can filter directly into graylog but the reboot of 150 servers > >> generate thousand of lines > >> into graylog. > >> > >> I would like to avoid consuming bandwidth and storage on my graylog server > >> instead of filter on it. > >> > >> October 12, 2020 10:32 AM, "Rainer Gerhards" <[email protected]> > >> wrote: > >> > >> just an idea: could you filter out certain strings? > >> > >> Rainer > >> > >> El lun., 12 oct. 2020 a las 10:00, Unam via rsyslog > >> (<[email protected]>) escribió: > >> > >> Hi there, > >> > >> I am using rsyslog to send all our logs on a remote graylog server. The > >> config on every host > >> (Debian 9 & 10) is quite simple, we send by default everything. > >> All our servers are rebooted every night and we receive tons of logs that > >> we don't care about. > >> > >> My question is maybe very simple but, is there an option in rsyslog to > >> filters this logs and don't > >> send them to the remote ? > >> > >> I searched in the doc but nothing seems to talk about boot sequence. I > >> already tried to edit > >> grub.cfg to make the boot process silent without success. > >> > >> Thanks for your hints. > >> > >> Regards, > >> _______________________________________________ > >> rsyslog mailing list > >> https://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our > >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > >> _______________________________________________ > >> rsyslog mailing list > >> https://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our > >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
