I think what Rainer is saying is that *.debug matches all events of priority debug or higher from all facilities, and therefore it matches local6.info <http://local6.info/>, but that seems odd to me.
Either way it seems that you have the solution being… *.debug;local6.!=info > On Nov 2, 2022, at 14:27, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog > <[email protected]> wrote: > > So, what would be the correct way to start with *.debug, then reduce to > priority .err and higher for particular facilities, like local6? > > From: [email protected] At: 11/02/22 15:18:21 UTC-4:00To: > [email protected] > Cc: [email protected] > Subject: Re: [rsyslog] Reducing selector effect in RainerScript > > Info is higher severity than debug, so it validly matches. > > Sent from phone, thus brief. > > David Lang via rsyslog <[email protected]> schrieb am Mi., 2. Nov. > 2022, 20:10: > >> not that I expect this to fix it (this isn't something I've seen as a >> known >> bug), but could you please confirm that this still happens on the current >> version of rsyslog? >> >> David Lang >> >> On Wed, 2 Nov 2022, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog wrote: >> >>> Date: Wed, 2 Nov 2022 19:01:22 -0000 >>> From: "Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog" >>> <[email protected]> >>> Reply-To: Gordon Marler <[email protected]>, >>> rsyslog-users <[email protected]> >>> To: [email protected] >>> Cc: "Gordon Marler (BLOOMBERG/ 120 PARK)" <[email protected]> >>> Subject: Re: [rsyslog] Reducing selector effect in RainerScript >>> >>> I've stripped down my config to just this rule, and tried with and >> without the stop directive - after restarting rsyslogd, of course - no >> change. >>> >>> Also happens on the rsyslogd versions delivered with Solaris 11.4, RHEL >> 7.x and RHEL 8.x, which all hover around the 8.210x version >>> >>> From: [email protected] At: 11/02/22 03:45:01 UTC-4:00To: >> [email protected] >>> Cc: [email protected] >>> Subject: Re: [rsyslog] Reducing selector effect in RainerScript >>> >>> Generally, your config should work the way you indended. It's hard to >>> say however if other entries in your config don't cause any side effects. >>> >>> You could add a "stop" directive to make sure that events matching your >>> selector won't be processed further. Like: >>> >>> *.debug;local6.err { >>> action( type="omfile" file="/what/ever/file") >>> stop >>> } >>> >>> On 2.11.2022 01:26, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog >> wrote: >>>> I'm porting some configurations from syslog to rsyslog, and seeing some >>> unexpected selector behavior in rsyslog 8.2104 >>>> >>>> After reading the selector examples from the configuration portion of >> the >>> rsyslog manual, I'm either misunderstanding how this is supposed to >> work, or >>> there's a long standing issue here. >>>> >>>> So, the original selector looks like this: >>>> >>>> *.debug;local6.err >>>> >>>> The intent is to log all facilities at debug or higher, except for >> local6, >>> which should only log at err or higher. So I end up with a RainerScript >> block >>> like so: >>>> >>>> *.debug;local6.err { >>>> action( type="omfile" file="/what/ever/file") >>>> } >>>> >>>> But, I start to see messages at local6.info show up in the file, >> surprisingly. >>>> >>>> To get the desired end effect, I end up having to craft the selector >> like so >>> (which only works because only local6.info is chatty, nothing higher >> than >>> that), which surprises me: >>>> >>>> *.debug;local6.err;local6.!=info >>>> >>>> So, am I simply doing this wrong/misunderstanding how selectors work, >> or is >>> there something odd going on? >>>> >>>> >>>> _______________________________________________ >>>> rsyslog mailing list >>>> https://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE >>> THAT. >>> _______________________________________________ >>> rsyslog mailing list >>> https://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE >>> THAT. >>> >>> >>> _______________________________________________ >>> rsyslog mailing list >>> https://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >>> >> _______________________________________________ >> rsyslog mailing list >> https://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE > THAT. > > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
