I want to save log messages from program foobar with log level err into file /var/log/foobar.log in rsyslogd. How can I do that?

This is how I can filter messages by program name:

:programname,contains,"foobar" /var/log/foobar.log

This is how I can filter messages by log level:

*.err /var/log/foobar.log

But I don't understand how to filter by both these filters at the same time.

2 Answers 2


This example on the rsyslogd wiki suggests a way to do something like you want. It's the Filtering by program name using the expression-based syntax part.

Using the example provided on the wiki:

if $programname == 'foobar' and $syslogseverity-text == 'error' then /var/log/foobar.log 

Put that on rsyslogd.conf or as a snippet inside rsyslog.d


a simple way to do that is ... if ( $program contains "foobar" ) and ( $severity contains "err" ) then /var/log/foobar.log

Of course there are many other ways, but i think that the above is quite straight forward.

  • I like this syntax, but it doesn't work in version 8 (Debian 10). Jul 12, 2020 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.