• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer navigation

The Geek Diary

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • VCS
  • Interview Questions
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
  • DevOps
    • Docker
    • Shell Scripting
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

/etc/rsyslog.conf – Setup a Filter to Discard or Redirect Messages

by admin

The post outlines steps to create a Property-Based Filter to Discard( suppress ) a particular message or redirect program messages to a particular log file.

The syntax

The systax to write a Property-Based Filter is as shown below:

:[Available Properties], [compare-operations], [customized expression] [path/log file]

From the man page of rsyslog.conf

compare operations supported by rsyslog

The Discard Action (~)

If the discard action is carried out, the received message is immediately discarded. Discard is just the single tilde character with no further parameters.

Example:

*.*   ~      # discards everything.

Restart rsyslog

You need to restart the rsyslog service after updating the rsyslog.conf

# service rsyslog restart        # CentOS/RHEL 6
# systemctl restart rsyslog      # CentOS/RHEL 7

Example 1: Discard (suppress) a particular message

You have a messages as shown below which you want to discard or supress:

June 4 22:20:21 geeklab app: [804617.902850] this is a test message to discard

Add the rule as shown below to the /etc/rsyslog.conf file:

# vi /etc/rsyslog.conf
:msg, contains, "test message to discard"    ~

Restart the rsyslog service after updating the rsyslog.conf file.

# service rsyslog restart        # CentOS/RHEL 6
# systemctl restart rsyslog      # CentOS/RHEL 7

Example 2: Redirect program messages to a particular log file but not to messages

You have a messages as shown below which you want to redirect to a particular file, /var/log/custom_app.log in this example:

June 4 22:20:21 geeklab appname: [804617.902850] this is a test message to discard

Add the rule as shown below to the /etc/rsyslog.conf file:

:programname, isequal, "appname" /var/log/custom_app.log
:programname, isequal, "appname" ~

Restart the rsyslog service after updating the rsyslog.conf file.

# service rsyslog restart        # CentOS/RHEL 6
# systemctl restart rsyslog      # CentOS/RHEL 7

Filed Under: CentOS/RHEL 6, CentOS/RHEL 7, Linux

Some more articles you might also be interested in …

  1. powertop Command Examples in Linux
  2. How To Use distro-sync Option With dnf To Upgrade OS (CentOS/RHEL 8)
  3. pw-play Command Examples in Linux
  4. binwalk: command not found
  5. Linux Interview Questions – Basic File and Directory Permissions
  6. How to use FTP under Linux to transfer files
  7. virsh Command Examples in Linux
  8. libreoffice: command not found
  9. Understanding the /etc/inittab File in Linux
  10. shred: command not found

You May Also Like

Primary Sidebar

Recent Posts

  • raw: command not found
  • raw Command Examples in Linux
  • rankmirrors Command Examples in Linux
  • radeontop: command not found

© 2023 · The Geek Diary

  • Archives
  • Contact Us
  • Copyright