Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a rsyslog rule to split up all logging from snoopy into a file for each user

~$ cat /etc/rsyslog.d/10-snoopy.conf
$template DYNsnoopy,"/var/log/snoopy/uid.%msg:R,ERE,1,BLANK:uid:([0-9]*)--end%.log"
:programname, isequal, "snoopy" ?DYNsnoopy
& ~

example output:

~$ tail /var/log/snoopy/uid.1000.log
Feb 13 10:17:38 box snoopy[32108]: [uid:1000 sid:2781 tty: cwd:/home/user filename:/usr/bin/cut]: cut -d   -f 1-3 /proc/loadavg 
Feb 13 10:17:57 box snoopy[32158]: [uid:1000 sid:27176 tty:/dev/pts/2 cwd:/home/user filename:/usr/bin/colortail]: colortail /var/log/snoopy/uid.1000.log 

I want to alter the rule, such that if the command was run on a terminal it goes into its own file - This way I can keep a complete history of commands that I've executed, and rotate commands run by cron etc ..

However I'm unsure about the syntax related to nested if statements, or if this can even be done.

if $programname == 'snoopy' then
  $template DYNsnoopy,"/var/log/snoopy/uid.%msg:R,ERE,1,BLANK:uid:([0-9]*)--end%.log"

  # if msg contains tty:/dev/pts/2 write to tty.log, else write to
  if $msg ereregex "tty:([A-z0-9/]*) cwd" then /var/log/snoopy/tty.log
  *.* ?DYNsnoopy
  & ~
share|improve this question
up vote 1 down vote accepted

Not 100% happy, but this will only log messages captured on a tty to the snoopy log directory

$template DYNsnoopy,"/var/log/snoopy/uid.%msg:R,ERE,1,BLANK:uid:([0-9]*)--end%.log"
if $programname == 'snoopy' and not ($msg contains 'tty: cwd') then -?DYNsnoopy                                                                                                                    
& ~
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.