7

I want to save log messages from program foobar with log level err into file /var/log/foobar.log in rsyslogd. How can I do that?

This is how I can filter messages by program name:

:programname,contains,"foobar" /var/log/foobar.log

This is how I can filter messages by log level:

*.err /var/log/foobar.log

But I don't understand how to filter by both these filters at the same time.

2 Answers 2

7

This example on the rsyslogd wiki suggests a way to do something like you want. It's the Filtering by program name using the expression-based syntax part.

Using the example provided on the wiki:

if $programname == 'foobar' and $syslogseverity-text == 'error' then /var/log/foobar.log 

Put that on rsyslogd.conf or as a snippet inside rsyslog.d

3
3

a simple way to do that is ... if ( $program contains "foobar" ) and ( $severity contains "err" ) then /var/log/foobar.log

Of course there are many other ways, but i think that the above is quite straight forward.

1
  • I like this syntax, but it doesn't work in version 8 (Debian 10). Jul 12, 2020 at 0:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .