Following are the some contents of my /etc/syslog-ng/syslog-ng.confrelated to logging in to the file debug.log

source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip( port(514)); };

destination d_mesg { file("/tmp/log/debug.log"); };

filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); };

log { source(s_sys); filter(f_filter2); destination(d_mesg); };

I would like to take your attention towards the line containing "filter". There you can see that i am filtering out the logs from mail, authpriv and cron. As far as my knowledge goes, mail, authpriv and cron are pre-defined facilities of syslog.

My query is :

I have a written a daemon named "pm" which also uses the syslog APIs for logging. Now whatever my daemon logs, goes into the file /tmp/log/debug.log as you can see above. I would like to filter out the logs of "pm" from going into /tmp/log/debug.log. To make it more clear i would like to have the filter like

filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron,pm); };

Please Note : the difference in f_filter2 compared to above.

Is it possible to do this ? How can i prevent pm logs from going into /tmp/log/debug.log?

1 Answer 1


I got the answer.

We can create filters using the filter keyword:

filter <filtername> { expression; };

Where expression is a simple boolean expression. You can use "and", "or" and "not" to connect builtin functions. Functions can be one of:

  • facility(list of comma seperated facility names)

  • level(list of comma seperated priority nammes OR a range separated by "..")

  • program(regexp to match program name)

  • host(regexp to match program name)

  • match(regexp to match program name)

So, if we want to add our own program, for example "pm", to the filter use it like this:

filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron) and program(pm); };

And if we want to filter out the log messages of "pm", use the filter like this :

filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron) and not program(pm); };

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.