The instructions I was adapting from were here: http://www.apcupsd.org/manual/manual.html#implementation-details
I posted to their mailing list first, but they indicated that rsyslog questions should be addressed elsewhere. I first tried on the Linux Mint forums and then here when I received no response there. After feedback on this list I have revised my approach. This appears to be working: # attempt to get apcupsd logging working properly # # new approach after discussion on mailing list # # cribbing approach from 20-ufw.conf # # Everything for apcupsd goes here # local0.info;local0.!notice /var/log/apcupsd.data & stop local0.notice;local0.!warn |/var/log/apcupsd.status & stop local0.warn /var/log/apcupsd.events & stop # # If I understand this correctly should route selected entries # to apcupsd.* files and remove them from further logging # any unaddressed apcupsd logging should wind up in /var/log/syslog # Anything in the above appear to need correction? Did I miss anything? Thanks again for the assistance. Dave > Nathan Stratton Treadway wrote: On Wed, Dec 18, 2019 at 16:28:11 -0500, > David H. Durgee via rsyslog wrote: >> I have added a file acpupsdlog.conf to my /etc/rsyslog.d directory to >> handle the logging, but am encountering unexpected results. >> As per apcupsd recommendation their log data has a facility setting of > (Can you give a pointer to the exact instructions you were following?) > >> local0. Their example file was for syslog so I had to adapt it >> slightly. The contents of my file are: >> >> # attempt to get apcupsd logging working properly >> # >> # exclude all apcupsd info by default >> *.info;local0.none /var/log/syslog >> >> # Everything for apcupsd goes here >> local0.info;local0.!notice /var/log/apcupsd.data >> local0.notice;local0.!warn |/var/log/apcupsd.status >> local0.warn /var/log/apcupsd.events > A big difference between old-style syslog and modern rsyslog is that the > former used a monolithic config file but rsyslog (and rsyslog under > Ubuntu in particular) uses multiple config-file snippets. > > In this case it looks like the example file in your instructions was > intented to be the entire configuration file (following the syslog > style)... but for a modern Ubuntu-based system, the file you create > should instead be limited to dealing with just to apcupsd messages (see > below). > > >> This does appear to get the apcupsd logging to the /var/log/apcupsd.* as >> expected, but I am also seeing the logging that goes to the >> /var/log/apcupsd.data file in the /var/log/syslog file. As per the >> comments above the first functional line, I had expected none of the >> apcupsd logging to be included in the /var/log/syslog file. Is there a >> problem with the line? Is there an edge condition that got missed? > Actually, are all non-apcupsd messages are now appearing in the > /var/log/syslog file twice? I would expect so. once from the line > above, and once from the > *.*;auth,authpriv.none -/var/log/syslog > line in the 50-default.conf file.... > > In any case, I think the following hints should get you closer to what > you want: > > * name your new file with a 2-digit numeric prefix, something like > "30-acpupsdlog.conf", for consistency with Ubuntu-package-supplied > rsyslog.d/ files > > * remove the syslog line from your config file (thus allowing the > default line in 50-default.conf to control logging to that log file) > > * By design the default configuration puts (essentially) all messages > /in var/log/syslog, even messages that also go into other log files > (most notably in Xenial, messages that go into mail.log also go into > syslog). > > But as David mention, if you want to exclude the apcupsd messages > from syslog then you can use a > local0.* stop > line at the bottom of your config file to prevent those messages from > being processeed by later config directives. > > (For this to work you must be sure the order of the config files is > correct -- that's why Ubuntu uses the sequence-number prefixes on > the config files, and why I suggested "30-" as the prefix in your > case, to make sure it sorts before "50-default.conf".) > > > > Nathan > > ---------------------------------------------------------------------------- > Nathan Stratton Treadway - [email protected] - Mid-Atlantic region > Ray Ontko & Co. - Software consulting services - http://www.ontko.com/ > GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt ID: 1023D/ECFB6239 > Key fingerprint = 6AD8 485E 20B9 5C71 231C 0C32 15F3 ADCD ECFB 6239 >
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
