Is there a way that Rsyslog server logs all the messages except smartd messages. I only want "Currently unreadable (pending) sectors" to not get logged.
1 Answer
Yes, there is. The rule that is logging these messages need to be inside a filter, like this one: (Suppose that smartd messages are being logged in /var/log/smartd.log)
if ($programname == "smartd") then {
if not ($msg contains "Currently unreadable (pending) sectors") then {
*.* /var/log/smartd.log
}
stop
}
The above code will match all messages that is from smartd service. If the message don't have that string, it'll log all messages in /var/log/smartd.log, but if it contains that string, it won't log. All logs past this point will be dropped by the stop rule.
You can put this piece of code in a file in /etc/rsyslog.d/ ending with .conf, like 01-smartd.conf. As rsyslog.conf loads all files in this directory that ends with .conf, files starting with 00 between 49 will be read first than the default one, 50-default.conf.
Note that with the stop rule in the code, if read first, the messages won't reach the rules in 50-default.conf, so no duplicate messages will exist.
-
-
1rsyslog.conf loads all files with .conf in this directory, /etc/rsyslog.d/ (I'm using ubuntu server as example). The default rules are defined in 50-default.conf, so you can put this rule there or make a file yourself, like 01-smartd.conf and put this rule into it. Every file that starts with a number between 0 and 49 will be read first than the 50-default.conf. I'll edit my post to clarify things better. Oct 20, 2016 at 17:40
smartctl -t long /dev/sdb