MonitorWare Knowledge Base

Hi Guys,

I am wondering if it is possible to configure rsyslog to log a message only once on first match rather then continuing to process.

My logic is I want a catch all at the bottom of my file logging every that I havent specifically logged previously.

I am running version 3.19.9.

Cheers,

Tony

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

Hi,

Your idea is good but I think it wont work. Instead you just look at the recent log data by using tail command .

If one message occurs more number of times (2 or more) consecutively you get the message saying that last message repeated 'n' number of times.

Cheers,
Prakash

prakash.akumalla wrote: If one message occurs more number of times (2 or more) consecutively you get the message saying that last message repeated 'n' number of times.

This depends on the configuration. v3 by default does NOT do this. With v2, you can turn it off by specifying the -e command line option.

PhoenixMage wrote:Hi Guys,

I am wondering if it is possible to configure rsyslog to log a message only once on first match rather then continuing to process.

My logic is I want a catch all at the bottom of my file logging every that I havent specifically logged previously.

I am running version 3.19.9.

Cheers,

Tony

That's indeed an interesting idea, but requires a lot of plumbing. It is on the long term todo list. I assume that you do not want to configure any specific message context (if that would be OK, there could be some work-arounds).

Rainer

PhoenixMage wrote:Hi Guys,

I am wondering if it is possible to configure rsyslog to log a message only once on first match rather then continuing to process.

My logic is I want a catch all at the bottom of my file logging every that I havent specifically logged previously.

I am running version 3.19.9.

Cheers,

Tony

In a kind of roundabout way, yes.

Giving the tilde (~) as an action causes that message to be discarded. There's also the ampersand syntax - if a line starts with & it is considered an additional action for the previous line's selector. So something like this:

Code: Select all

mail.* /var/log/mail.log
& ~

kern.* /var/log/kern.log
& ~

*.* /var/log/catchall


Would log all mail messages to /var/log/mail.log, then drop them. Kernel messages to /var/log/kern.log, and then gone. Whatever's left goes in /var/log/catchall.

-HKS

Thanks, that is exactly what I was after.

Cheers,

Tony

Thanks, HKS. I totally misunderstood what was asked for (I guess I had a bias towards the missing feature blocking my view ).

Rainer

Good work HKS, I really appreciate you.

cheers,
Prakash

Awww...

-HKS