2

I try to configure get my template for remote logging working but the stop statement is ignored and everiting is logged duplicate in the syslog and in my generated file %programname%.log. I want the incoming messages only logged in %programname%.log

ZABBIXis my local machine where the rsyslog deamon runs. And the remote devices are Sierra wireless devices that are logging to ZABBIX. But everything from the Sierras is logged duplicate. This is my configuration in /etc/rsyslog.conf.

$template remote-logs,"/media/jarne/Data/log/%FROMHOST%/%programname%.log", stop
:fromhost,isequal,"ZABBIX" stop
*.* ?remote-logs

I have also tried: *.* ?remote-logs & stop and *.* ?remote-logs;stop, but I only get errors.

Can anyone tell me how the stop keyword works and where that is valid?

I use rsyslog version 8.32.0 on a Ubuntu 18.04.3. Thanks in advance!

2
  • I presume you want to stop logs from remote host zabbix being logged. isequal is case-sensitive, so perhaps fromhost is "zabbix", so does not match. You could try startswith_i instead, which ignores case, but will also match, for example, "zabbix99".
    – meuh
    Commented Dec 13, 2019 at 19:58
  • No, sorry, I don't formulated my question good enough, ZABBIX is my local machine where the rsyslog deamon runs. I have enabled remote logging on ZABBIX. And the remote machines are Sierra Wireless devices. The Sierras are logging to Zabbix, but the logs of the Sierras are logged to the syslog and %programme%.log. How can I prevent that the Sierra's are logging to the syslog?
    – Jarne
    Commented Dec 16, 2019 at 8:44

1 Answer 1

1

If your hostname is lowercase zabbix then

:fromhost,isequal,"zabbix" stop
*.* ?remote-logs

should ensure that your remote-logs file does not hold local messages, provided that these lines are at the end of the rsyslog config. However, it would then be too late to stop remote messages going to your local syslog.

It is simpler if you use a newer syntax called RainerScript where you can write things like

if ($fromhost == "zabbix") then {
  *.* /var/log/syslog
} else {
  *.* ?remote-logs
}
2
  • Yes, I have solved my problem by writing and if statement and appending the & stop in the if. Everything seems to work with my if.
    – Jarne
    Commented Dec 16, 2019 at 13:00
  • 1
    This is my if: if($fromhost != "ZABBIX") then { *.* ?remote-logs & stop }
    – Jarne
    Commented Dec 16, 2019 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .