Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I set up haproxy logging via rsyslogd using the tips from this article, and everything seems to be working fine. The log files get the log messages.

However, every log message from haproxy also shows up at /var/log/syslog. This means that once the server goes live, the syslog will be quite useless, as it will be run over with haproxy log messages.

I would like to filter out those messages from /var/log/syslog. After going over the rsyslogd documentation, I tried to change the file /etc/rsyslog.d/50-default.conf thus:

*.*;auth,authpriv.none;haproxy.none     -/var/log/syslog

I simply added the ;haproxy.nonepart. After restarting rsyslogd it stopped working completely until I reverted my changes.

What am I doing wrong?

share|improve this question

2 Answers 2

up vote 14 down vote accepted

You could also do the following which will make it so they don't go in any other logs:

local0.*                        -/var/log/haproxy.log
& ~

The & ~ means not to put what matched in the above line anywhere else for the rest of the rules.

share|improve this answer
Thanks. This does seem to make more sense than having to edit the main configuration. –  itsadok Dec 21 '10 at 9:03
Worth noting that if you do this, your local0.* line must be processed before the "." line in /etc/rsyslog.d/50-default.conf. I created a file called /etc/rsyslog.d/haproxy.conf to contain my haproxy-specific logging config, but it logged to syslog despite having a "& ~" at the end. This is because (of course) 50-default.conf is loaded before haproxy.conf so the catchall "." was matched before my "local0.*" line. The solution was to rename my haproxy-specific file to /etc/rsyslog.d/49-haproxy.conf –  Giles Thomas Nov 16 '12 at 15:57
FYI a small update rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ] –  KCD Apr 15 at 4:04

Ok, I figured it out. This is what my /etc/rsyslog.d/20-haproxy.conf looks like:

$ModLoad imudp
$UDPServerRun 514

local0.* -/var/log/haproxy_0.log
local1.* -/var/log/haproxy_1.log

I changed the line in 50-default.conf to:

*.*;auth,authpriv,local0,local1.none     -/var/log/syslog

And now it seems to be doing what I want.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.