Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I set up haproxy logging via rsyslogd using the tips from this article, and everything seems to be working fine. The log files get the log messages.

However, every log message from haproxy also shows up at /var/log/syslog. This means that once the server goes live, the syslog will be quite useless, as it will be run over with haproxy log messages.

I would like to filter out those messages from /var/log/syslog. After going over the rsyslogd documentation, I tried to change the file /etc/rsyslog.d/50-default.conf thus:

*.*;auth,authpriv.none;haproxy.none     -/var/log/syslog

I simply added the ;haproxy.nonepart. After restarting rsyslogd it stopped working completely until I reverted my changes.

What am I doing wrong?

share|improve this question

3 Answers 3

up vote 15 down vote accepted

You could also do the following which will make it so they don't go in any other logs:

local0.*                        -/var/log/haproxy.log
& ~

The & ~ means not to put what matched in the above line anywhere else for the rest of the rules.

share|improve this answer
Thanks. This does seem to make more sense than having to edit the main configuration. –  itsadok Dec 21 '10 at 9:03
Worth noting that if you do this, your local0.* line must be processed before the "." line in /etc/rsyslog.d/50-default.conf. I created a file called /etc/rsyslog.d/haproxy.conf to contain my haproxy-specific logging config, but it logged to syslog despite having a "& ~" at the end. This is because (of course) 50-default.conf is loaded before haproxy.conf so the catchall "." was matched before my "local0.*" line. The solution was to rename my haproxy-specific file to /etc/rsyslog.d/49-haproxy.conf –  Giles Thomas Nov 16 '12 at 15:57
FYI a small update rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try ] –  KCD Apr 15 at 4:04
This discusses the use of & stop instead of & ~: –  slm Aug 31 at 17:44

Ok, I figured it out. This is what my /etc/rsyslog.d/20-haproxy.conf looks like:

$ModLoad imudp
$UDPServerRun 514

local0.* -/var/log/haproxy_0.log
local1.* -/var/log/haproxy_1.log

I changed the line in 50-default.conf to:

*.*;auth,authpriv,local0,local1.none     -/var/log/syslog

And now it seems to be doing what I want.

share|improve this answer

The use of & ~ was deprecated in v7 of rsyslogd, and you're encouraged to use & stop instead. You can read more about it in this section of the v7compatibility page.

omruleset and discard (~) action are deprecated

Both continue to work, but have been replaced by better alternatives.

The discard action (tilde character) has been replaced by the “stop” RainerScript directive. It is considered more intuitive and offers slightly better performance.

The omruleset module has been replaced by the “call” RainerScript directive. Call permits to execute a ruleset like a subroutine, and does so with much higher performance than omruleset did. Note that omruleset could be run off an async queue. This was more a side than a desired effect and is not supported by the call statement. If that effect was needed, it can simply be simulated by running the called rulesets actions asynchronously (what in any case is the right way to handle this).

Note that the deprecated modules emit warning messages when being used. They tell that the construct is deprecated and which statement is to be used as replacement. This does not affect operations: both modules are still fully operational and will not be removed in the v7 timeframe.

So for HAProxy something like this instead:

$ more /etc/rsyslog.d/haproxy.conf
local2.*    /var/log/haproxy.log
& stop

As to how it works, the & stop tells rsyslogd to discard any additional messages that matched the previously matched rules up to this point. To guarantee that this rule is picked up early on, you can change the name of the file from /etc/rsyslog.d/haproxy.conf to /etc/rsyslog.d/00-haproxy.conf.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.