Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to save log messages from program foobar with log level err into file /var/log/foobar.log in rsyslogd. How can I do that?

This is how I can filter messages by program name:

:programname,contains,"foobar" /var/log/foobar.log

This is how I can filter messages by log level:

*.err /var/log/foobar.log

But I don't understand how to filter by both these filters at the same time.

share|improve this question
up vote 2 down vote accepted

This example on the rsyslogd wiki suggests a way to do something like you want. It's the Filtering by program name using the expression-based syntax part.

Using the example provided on the wiki:

if $programname == 'foobar' and $syslogseverity-text == 'error' then /var/log/foobar.log 

Put that on rsyslogd.conf or as a snippet inside rsyslog.d

share|improve this answer
Please add a summary to your answer. – Dennis Williamson Feb 2 '11 at 13:28
Thank you! Where can I find list of all variables like $programname and $syslogseverity-text? – Marko Kevac Feb 2 '11 at 14:34
I found it on this list: – coredump Feb 3 '11 at 2:02

a simple way to do that is ... if ( $program contains "foobar" ) and ( $severity contains "err" ) then /var/log/foobar.log

Of course there are many other ways, but i think that the above is quite straight forward.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.