1

Is there a way that Rsyslog server logs all the messages except smartd messages. I only want "Currently unreadable (pending) sectors" to not get logged.

3
  • So, your hard drive is failing, and you want to ignore it?! Oct 16, 2016 at 16:02
  • No, its a test server. And is of no priority. And its showing the same block "Device: /dev/sdb, 1 Currently unreadable (pending) sectors" message since last 4 years.
    – OmiPenguin
    Oct 17, 2016 at 8:10
  • 1
    Run a long self-test, that should clear the error (or determine your drive is really bad). e.g. smartctl -t long /dev/sdb Oct 19, 2016 at 19:40

1 Answer 1

2

Yes, there is. The rule that is logging these messages need to be inside a filter, like this one: (Suppose that smartd messages are being logged in /var/log/smartd.log)

if ($programname == "smartd") then {
  if not ($msg contains "Currently unreadable (pending) sectors") then {
    *.* /var/log/smartd.log
  }
  stop
}

The above code will match all messages that is from smartd service. If the message don't have that string, it'll log all messages in /var/log/smartd.log, but if it contains that string, it won't log. All logs past this point will be dropped by the stop rule.

You can put this piece of code in a file in /etc/rsyslog.d/ ending with .conf, like 01-smartd.conf. As rsyslog.conf loads all files in this directory that ends with .conf, files starting with 00 between 49 will be read first than the default one, 50-default.conf.

Note that with the stop rule in the code, if read first, the messages won't reach the rules in 50-default.conf, so no duplicate messages will exist.

2
  • So this one should be rsyslog.conf file ?
    – OmiPenguin
    Oct 20, 2016 at 6:51
  • 1
    rsyslog.conf loads all files with .conf in this directory, /etc/rsyslog.d/ (I'm using ubuntu server as example). The default rules are defined in 50-default.conf, so you can put this rule there or make a file yourself, like 01-smartd.conf and put this rule into it. Every file that starts with a number between 0 and 49 will be read first than the 50-default.conf. I'll edit my post to clarify things better. Oct 20, 2016 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .