Is there any way to filter messages sent to rsyslog by user id? Let's say I want to ensure, that only messages sent by root should be logged to a separate file (based on rsyslog rules) and messages generated by non-privileged users (e.g. using logger utility) will be discarded.
Yes you can.
load="imuxsock" line in
module(load="imuxsock" SysSock.Annotate="on" SysSock.ParseTrusted="on")
Add to Syslog config:
if $!uid == '0' then /var/log/root.log if $!uid == '33' then /var/log/www-data.log
I have learnt this here.