I think what Rainer is saying is that *.debug matches all events of priority
debug or higher from all facilities, and therefore it matches local6.info
<http://local6.info/>, but that seems odd to me.
Either way it seems that you have the solution being…
*.debug;local6.!=info
> On Nov 2, 2022, at 14:27, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog
> <rsyslog@lists.adiscon.com> wrote:
>
> So, what would be the correct way to start with *.debug, then reduce to
> priority .err and higher for particular facilities, like local6?
>
> From: rsyslog@lists.adiscon.com At: 11/02/22 15:18:21 UTC-4:00To:
> rsyslog@lists.adiscon.com
> Cc: rgerha...@hq.adiscon.com
> Subject: Re: [rsyslog] Reducing selector effect in RainerScript
>
> Info is higher severity than debug, so it validly matches.
>
> Sent from phone, thus brief.
>
> David Lang via rsyslog <rsyslog@lists.adiscon.com> schrieb am Mi., 2. Nov.
> 2022, 20:10:
>
>> not that I expect this to fix it (this isn't something I've seen as a
>> known
>> bug), but could you please confirm that this still happens on the current
>> version of rsyslog?
>>
>> David Lang
>>
>> On Wed, 2 Nov 2022, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog wrote:
>>
>>> Date: Wed, 2 Nov 2022 19:01:22 -0000
>>> From: "Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog"
>>> <rsyslog@lists.adiscon.com>
>>> Reply-To: Gordon Marler <gmar...@bloomberg.net>,
>>> rsyslog-users <rsyslog@lists.adiscon.com>
>>> To: rsyslog@lists.adiscon.com
>>> Cc: "Gordon Marler (BLOOMBERG/ 120 PARK)" <gmar...@bloomberg.net>
>>> Subject: Re: [rsyslog] Reducing selector effect in RainerScript
>>>
>>> I've stripped down my config to just this rule, and tried with and
>> without the stop directive - after restarting rsyslogd, of course - no
>> change.
>>>
>>> Also happens on the rsyslogd versions delivered with Solaris 11.4, RHEL
>> 7.x and RHEL 8.x, which all hover around the 8.210x version
>>>
>>> From: rsyslog@lists.adiscon.com At: 11/02/22 03:45:01 UTC-4:00To:
>> rsyslog@lists.adiscon.com
>>> Cc: k...@epsilon.eu.org
>>> Subject: Re: [rsyslog] Reducing selector effect in RainerScript
>>>
>>> Generally, your config should work the way you indended. It's hard to
>>> say however if other entries in your config don't cause any side effects.
>>>
>>> You could add a "stop" directive to make sure that events matching your
>>> selector won't be processed further. Like:
>>>
>>> *.debug;local6.err {
>>> action( type="omfile" file="/what/ever/file")
>>> stop
>>> }
>>>
>>> On 2.11.2022 01:26, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog
>> wrote:
>>>> I'm porting some configurations from syslog to rsyslog, and seeing some
>>> unexpected selector behavior in rsyslog 8.2104
>>>>
>>>> After reading the selector examples from the configuration portion of
>> the
>>> rsyslog manual, I'm either misunderstanding how this is supposed to
>> work, or
>>> there's a long standing issue here.
>>>>
>>>> So, the original selector looks like this:
>>>>
>>>> *.debug;local6.err
>>>>
>>>> The intent is to log all facilities at debug or higher, except for
>> local6,
>>> which should only log at err or higher. So I end up with a RainerScript
>> block
>>> like so:
>>>>
>>>> *.debug;local6.err {
>>>> action( type="omfile" file="/what/ever/file")
>>>> }
>>>>
>>>> But, I start to see messages at local6.info show up in the file,
>> surprisingly.
>>>>
>>>> To get the desired end effect, I end up having to craft the selector
>> like so
>>> (which only works because only local6.info is chatty, nothing higher
>> than
>>> that), which surprises me:
>>>>
>>>> *.debug;local6.err;local6.!=info
>>>>
>>>> So, am I simply doing this wrong/misunderstanding how selectors work,
>> or is
>>> there something odd going on?
>>>>
>>>>
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com/professional-services/
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of
>>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE
>>> THAT.
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of
>>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE
>>> THAT.
>>>
>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>>>
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE
> THAT.
>
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
