Avoid logging in /var/log/syslog only using /etc/syslog-ng/conf.d/

Question

How to tell syslog to send custom app's logs to a separate file and NOT into /var/log/syslog WITHOUT changing /etc/syslog-ng/syslog-ng.conf ?

I have a custom application that sends messages to syslog's local3 facility. As each message sent by this app begins with "[myapp]", I wrote this configuration to log into a separate file:

Content of /etc/syslog-ng/conf.d/myapp.conf:

filter f_myapp { facility(local3) and match("[myapp]"); };

destination d_myapp {
    file("/var/log/myapp/myapp.log" create_dirs(yes));
};

log {
    source(s_src);
    filter(f_myapp);
    destination(d_myapp);
};

And it works well: messages are going into /var/log/myapp/myapp.log

BUT, they also go to /var/log/syslog and /var/log/messages

To avoid that, we can edit /etc/syslog-ng/syslog-ng.conf and add "and not filter(f_myapp)" to filter f_messages {...} and filter f_syslog3 {...}

OK, but this is a manual task. Lets say that we want to automate logging configurations for many applications...

Is there any way to do that sort of exclusion without changing anything in /etc/syslog-ng/syslog-ng.conf, only using /etc/syslog-ng/conf.d/ ?

Answer 1

in syslog-ng, the log paths determine what happens with the messages.

By default, every log path receives every message from the sources included in the log path, and syslog-ng processes every log path in the order they appear in the configuration file.

You can use the flags() option in the log path to change this behavior (for details, see syslog-ng log flags).

To process your messages only in a specific log path, you have to:

• use the final flag in the log path

  log {
  source(s_src);
  filter(f_myapp);
  destination(d_myapp);
  flags(final)
  };
  

• Make sure that in your syslog-ng.conf file, this is the first log path that processes this message. You probably have a line like this in your syslog-ng.conf configuration file:

  @include "/etc/syslog-ng/conf.d/*.conf"
  

  Make sure that this appears before the other log paths. (If you have other files in the conf.d directory, this can interfere with the other files, in this case move the myapp.conf file somewhere else, and include only this file at the top.)