Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to discard lines like this:

httpd: - - - - [03/Jun/2013:23:04:10 +0000] "-" 408 - "-" "-" 32 -

Based on the docs, I would think this would suffice:

:msg, contains, "408 -" ~

I know that that is not a good pattern because it could match too many other things but I'm just trying to get it to work. Currently it doesn't work, the lines end up in the log file and the remote server.

I have a second :msg, contains below that, and that one DOES work. Is :msg not the correct field for this line for some reason?

Here's the complete rsyslog.conf:

$ModLoad imuxsock
$ModLoad imklog.so

$ActionQueueType LinkedList   # use asynchronous processing
$ActionQueueFileName srvrfwd  # set file name, also enables disk mode
$ActionResumeRetryCount -1    # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down

:msg, contains, "408 -" ~
:msg, contains, "enablerepo=private update" ~

*.* /var/log/messages
*.* @@logserver.mydomain
share|improve this question
    
And how exactly are you logging the Apache access log to syslog? –  Michael Hampton Jun 4 '13 at 0:56
1  
CustomLog "|/usr/bin/logger -p local6.info -t httpd" combined ErrorLog "|/usr/bin/logger -p local1.err -t httpd" –  jsd Jun 4 '13 at 16:27

1 Answer 1

up vote 0 down vote accepted

After conferring with rsyslog developers it appears to be a bug in the version we are using (5.8, provided by Amazon through their Amazon Linux distro). I upgraded to 7.4 and the problem went away. I informed Amazon and they are investigating whether upgrading to 7.4 is something they want to do for everyone going forward.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.