Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to save log messages from program foobar with log level err into file /var/log/foobar.log in rsyslogd. How can I do that?

This is how I can filter messages by program name:

:programname,contains,"foobar" /var/log/foobar.log

This is how I can filter messages by log level:

*.err /var/log/foobar.log

But I don't understand how to filter by both these filters at the same time.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

This example on the rsyslogd wiki suggests a way to do something like you want. It's the Filtering by program name using the expression-based syntax part.

Using the example provided on the wiki:

if $programname == 'foobar' and $syslogseverity-text == 'error' then /var/log/foobar.log 

Put that on rsyslogd.conf or as a snippet inside rsyslog.d

share|improve this answer
    
Please add a summary to your answer. –  Dennis Williamson Feb 2 '11 at 13:28
    
Thank you! Where can I find list of all variables like $programname and $syslogseverity-text? –  Marko Kevac Feb 2 '11 at 14:34
    
I found it on this list: rsyslog.com/doc/property_replacer.html –  coredump Feb 3 '11 at 2:02

a simple way to do that is ... if ( $program contains "foobar" ) and ( $severity contains "err" ) then /var/log/foobar.log

Of course there are many other ways, but i think that the above is quite straight forward.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.