Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several different django applications under apache on a Red Hat server. These applications use SysLogHandler for sending log messages to the local rsyslog service. In order to pipe log messages from different django applications to different files, we are using rsyslog tagging (based on syslogtag). Here's what we have in /etc/rsyslog.conf:

$template myFormat,"%msg%\n"
if $syslogfacility-text == 'local2' and $syslogtag == 'dev:'  then /var/log/ap/dev/ws.log;myFormat
if $syslogfacility-text == 'local2' and $syslogtag == 'rel:'  then /var/log/ap/rel/ws.log;myFormat

Works this way: if the log message is dev:Hello World!, Hello World! is written to /var/log/ap/dev/ws.log.

Everything worked fine until yesterday. Our system was upgraded from 6.2 to 6.3. According to yum history, rsyslog was updated from 4.6.2-12 to 5.8.10-2 version.

After debugging a bit, I've found that $syslogtag == 'dev:' condition doesn't work on the new rsyslog version. $syslogtag now eats a part of a message till the first space and contains dev:Hello instead of just dev:.

Could you please point me what to do with it and how to make rsyslog parse the tag correctly? (Changing log message format that comes from django applications is not an option)

Let me know if you need any additional info. Thank you.

share|improve this question
up vote 2 down vote accepted

If the applications have different names you could use the $programname filter.

If not you can use if $msg contains 'rel: ' then ....

I would suggest looking at

share|improve this answer
Thank you for pointing to use $programname, it makes the if condition work and I see log messages in the log file. But, the problem is that the actual log message is truncated by $syslogtag. Please see my comment to @Bgs answer. – alecxe Oct 14 '13 at 8:13
Hmm maybe it has something to do with your '==' expression. As a quick test I used :syslogtag, contains, "dev:" /var/log/test in my rsyslog.conf and tried logger -t dev: hello world and it seemed ok. – georgeb_ Oct 14 '13 at 11:57
may be this is a bug in this particular rsyslog version (5.8.10)..could you try the same test but using 5.8.10? Thanks. – alecxe Oct 14 '13 at 12:00
I'm using 5.8.10 on CentOS 6.4 rsyslogd -v rsyslogd 5.8.10. Could you give me a full event line to test with? – georgeb_ Oct 14 '13 at 12:22
Ok, let's test it on example. Here's rsyslog.conf that I'm using now for testing. When I run logger -t test:Hello World! - I see just World! in the log file. In other words, %msg% contains only World!, and %rsyslogtag% is equal to test:Hello..can you reproduce it? – alecxe Oct 14 '13 at 12:50

It's been a while I migrated but I believe you should use

$syslogtag startswith 'rel: '

instead of ==

share|improve this answer
This makes the if condition work, but log messages are truncated, e.g. if the message sent to rsyslog is rel:Hello World!, then the actual log message written to log file contains only World!, since $syslogtag "eats" a part of the log message and is equal to dev:Hello in this case. Don't know why. Thank you anyway. – alecxe Oct 14 '13 at 7:56
Have you tried with that additional space character? – Bgs Oct 15 '13 at 19:43
Yeah, it works if I add an additional space after the colon. Also, I have to cut this space from the %msg% in the template, like %msg:2:$\n. – alecxe Oct 15 '13 at 21:57

Thanks to other answers for helping to make the if condition work but the problem is that $msg doesn't contain the actual log message sent from an application since $syslogtag "eats" the part of the message until the first space in it.

As a workaround, I can change the log template and concatenate the missing message part from %syslogtag% and the %msg%:

$template myFormat,"%syslogtag:F,58:2%%msg%\n"

It takes the part of %syslogtag% after the colon (58 ascii code) and adds the %msg% after.

Luckily, this works for both 4.6.2-12 and 5.8.10-2 rsyslog versions. But, I don't think this a nice and clean solution, looks more like a hack. Also, I'm not sure this will work for future rsyslog versions.

Hope there will be other answers or comments.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.