Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Once again, i found that Rsyslog is not as flexible as i expected...

My application logs to LOCAL5.* ( depending on the severity )

I would like to see on my centralized log server only LOCAL5.WARNING and above

I assumed and tested            ~

However this means block LOCAL5.INFO and ABOVE

How do i make it block LOCAL5.INFO and BELOW ???

Suggestions please?

share|improve this question
up vote 3 down vote accepted

It seems

if $syslogfacility-text == 'local5' and $syslogseverity >= '5' then ~

did the trick...

share|improve this answer
Glad you resolved this issue. Please be sure to mark your answer as "accepted" when you are able. – jscott Jul 20 '12 at 3:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.