David, There is a fine detail Dave mentioned. For the syslog file he has
*.info;local0.none /var/log/syslog Note the "local0.none" part. That should ensure that the filter does not apply to local0 messages. Maybe the 50- file does a second write to /var/log/syslog. Also, the version is extremely old, it may simply be a bug. Dave: would it be possible to update to rsyslog current? 8.1911.0? Rainer El mié., 18 dic. 2019 a las 23:49, David Lang via rsyslog (<[email protected]>) escribió: > > syslog matches all filters unless you have a filter that says 'stop' (or ~ in > the obsolete format) as the action. > > That comment only applied to that one line, or the author was mistaken > > if you want to have rsyslog throw away a message, do something like > > loacl0.* stop > > and nothing after it in the file will process that messages > > make sure this is before your include. > > David Lang > > P.S. the 50-default was created by your distro. > > On Wed, 18 Dec 2019, David H. Durgee wrote: > > > Date: Wed, 18 Dec 2019 17:26:04 -0500 > > From: David H. Durgee <[email protected]> > > To: David Lang <[email protected]>, > > David H. Durgee via rsyslog <[email protected]> > > Subject: Re: [rsyslog] unexpected results with rsyslog > > > > David Lang wrote: > >> why would you expect the logs to not go into /var/log/syslog? > >> > >> don't the messages match the filter you have defined for that? > >> > >> do you have any filters that you don't show us that would throw away > >> the log before you get to that line? > >> > >> the logs get written to every line where the filters match, not just > >> the first one. > >> > >> David Lang > > > > I can't say that I am totally familiar with the rsyslog or its filters, > > so I am relying upon the original author of the .conf file. I read his > > comment "# exclude all apcupsd info by default" above the filter as > > defining its intent, and knowing that apcupsd is using local0 only I > > interpreted "local0.none" as indicating that nothing from local0 would > > go to /var/log/syslog. If this is not what the filter is doing then it > > needs to be corrected to do so. > > > > The other filters on the system are those in > > /etc/rsyslog.d/50-default.conf as installed on my distro. I am unsure > > if that was part of your package or if ubuntu created it. Let me know > > if you would need to see it. > > > > Dave > > > > > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
