Yes, I tried by filtering string but there many patterns to look for. I will stop kern.debug on few servers and will apply it globally if everything ok.
Thanks for all your quick reply. Regards, October 13, 2020 9:43 AM, "Rainer Gerhards" <[email protected]> wrote: >> I tried a solution, disabling kern.debug with : >> >> ``` >> kern.debug stop >> kern.* -/var/log/kern.log >> ``` >> >> This turned the log from 1000 lines to 150 after a reboot. >> >> Just to confirm, is this the correct way ? Does the kern.* still produces >> logs except for >> kern.debug ? > > yes > > As I said, you can also filter out based on some e.g. string inside > the message. Just so that you know. > > Rainer > >> Regards, >> >> October 12, 2020 11:05 AM, "Rainer Gerhards" <[email protected]> >> wrote: >> >> if you know how to filter at graylog, you can also filter out and >> discard those messages at rsyslog ;-) >> >> Rainer >> >> El lun., 12 oct. 2020 a las 10:40, Unam via rsyslog >> (<[email protected]>) escribió: >> >> Yep, I can filter directly into graylog but the reboot of 150 servers >> generate thousand of lines >> into graylog. >> >> I would like to avoid consuming bandwidth and storage on my graylog server >> instead of filter on it. >> >> October 12, 2020 10:32 AM, "Rainer Gerhards" <[email protected]> >> wrote: >> >> just an idea: could you filter out certain strings? >> >> Rainer >> >> El lun., 12 oct. 2020 a las 10:00, Unam via rsyslog >> (<[email protected]>) escribió: >> >> Hi there, >> >> I am using rsyslog to send all our logs on a remote graylog server. The >> config on every host >> (Debian 9 & 10) is quite simple, we send by default everything. >> All our servers are rebooted every night and we receive tons of logs that we >> don't care about. >> >> My question is maybe very simple but, is there an option in rsyslog to >> filters this logs and don't >> send them to the remote ? >> >> I searched in the doc but nothing seems to talk about boot sequence. I >> already tried to edit >> grub.cfg to make the boot process silent without success. >> >> Thanks for your hints. >> >> Regards, >> _______________________________________________ >> rsyslog mailing list >> https://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> https://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our >> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
