> *.*;auth,authpriv.none ~/var/log/syslog That line writes everything to /var/log/syslog
> On May 10, 2023, at 08:42, kathy lyons via rsyslog > <rsyslog@lists.adiscon.com> wrote: > > Good morning. I am trying to get the audit logs to be written only to > audit.log. Currently they are written to audit.log as well as syslog. > Here is my rsyslog.conf file - what a I doing wrong? > > module(load="imfile") > module(load="imklog") > module(load="imjournal") > > global(net.enableDNS="off" workDirectory=/var/spool/rsyslog" > maxMessageSize="128k") > > $IncludeConfig /etc/rsyslog.d/*.conf > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > > ##################### rules > audit.* ~/var/log/audit/audit.log > auth.warning;authpriv.info ~/var/log/auth.log > *.*;auth,authpriv.none ~/var/log/syslog > cron.info ~/var/log/cron.log > daemon.info ~/var/log/daemon.log > kern.* ~/var/log/kern.log > user.info ~/var/log/user.log > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
