MonitorWare Knowledge Base

I was using the 3.18 branch, and upgraded to the 3.21 branch to test this problem ... but it seems like negation isn't working for me:

Code: Select all

:msg,contains,"PeriodicStats" -/var/log/prstats
:msg,contains,"PeriodicStats" ~
$template prstats, "%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%%msg:::drop-last-lf%\n"
:syslogtag,contains,"PeriodicStats" -/var/log/prstats;prstats
:syslogtag,contains,"PeriodicStats" ~


So anything with PeriodicStats in the message, or the syslogtag, should go to /var/log/prstats. I think ...

Code: Select all

[root@dal-nms-01 rsyslog-3.21.5]# tail -f /var/log/messages|grep Periodic
Oct  7 20:05:51 ncc3-blade1 SRS: PeriodicStats


What do I have wrong? The messages appear in both locations:

Code: Select all

[root@dal-nms-01 log]# grep 'Oct  7 20:05:51' prstats
Oct  7 20:05:51 ncc3-blade1 SRS: PeriodicStats


• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

The excerpt looks good, but I do not know what the rest of rsyslog.conf looks like. Probably the issue is rooted in the invisible part Order of rules is important, so the discard must occur before the action to write to the general messages file.

Right again. I'm still running in compatibility mode which had the default:

*.info;mail.none;authpriv.none;cron.none /var/log/messages

So that's how they're getting there.

Duh.