Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several applications and scripts that I want to redirect the output to custom files.

I launch those applications using

command | logger -t TAG

I would like to filter these messages based on their tags and redirect them to different files. I don't want to use bash redirection as those applications are mainly long running process and need proper log rotation.

I have tried to add a custom filter in /etc/rsyslog.d/60-myfilter.conf ;

if $syslogtag == 'giomanager' then /var/log/giomanager.log

What am I doing wrong ? What is the proper way to filter based on the tag or is there a better option to have similar result?

share|improve this question

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try

:syslogtag, isequal, "giomanager:" /var/log/giomanager.log
& ~

The & ~ causes the matched message to be discarded after logging otherwise it will be further parsed by other rules.

Update: tested and

The syslogtag contains a : and should be enclosed in "" rather than ''

share|improve this answer
Thanks for your response. I just tried what you propose, indeed the message gets discarded but is never written to /var/log/giomanager.log – mistyrouge Jun 11 '13 at 12:21
@mistyrouge: see my update – Iain Jun 11 '13 at 13:09
Thank you very much, I now have my log redirected to /var/log/giomanager.log but it is still written to /var/log/syslog. Do you have an idea why this is happening and how to prevent it ? – mistyrouge Jun 11 '13 at 13:17
up vote 3 down vote accepted

So I finally found a solution to my problem.

Thank you very much to @lain for leading my way.

The solution as stated before is to include a ':' in the tag name. Also, and this is very important, the file name must be before 50-default.conf in alphabetical order.

To resume, put the following in 30-giomanager.conf :

:syslogtag, isequal, "giomanager:" /var/log/giomanager.log
& ~

Note that the file /var/log/giomanager.log should be writable by the 'syslog' user

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.