MonitorWare Knowledge Base

To start the thread, I'd like to mention that my audio is working fine. It's "good enough" at the moment that I can't be bothered to fix the headache that is pulseaudio. I've spent ample time already online researching the issue and either 1. a fix doesn't exist or 2. I haven't invested enough time yet (which is laughable). Anyways, on to my question.

A wc -l of /var/log/messages shows it has 20880 lines. If I reverse grep out the ratelimit.c messages, the repeated messages and the too big adjustment messages, it's 3363 lines. That's right, about 84% of my messages file is from pulseaudio.

So I was looking to move these errors to another file. I took a little bit of time to read through the documentation about configuration. But I'm unsure if pulseaudio is a recognized ummm, header? not sure if that's the right word. For example, in the config file, there's daemon.* kern.*, I don't suppose I can just put in pulseaudio.* /var/log/audio.log and be done with it.

i figure I might need to use some filter conditions? Does this look right?

Code: Select all

:msg, startswith, "pulseaudio" /var/log/audio.log
:msg, contains, "hda-intel" /var/log/audio.log


These are the 3 messages I would like to catch:

Code: Select all

Jan 17 18:21:03 lanfear kernel: [ 1729.967456] hda-intel: Too big adjustment 32
Jan 20 12:05:32 lanfear pulseaudio[2693]: ratelimit.c: 16 events suppressed
Jan 20 12:06:12 lanfear pulseaudio[2693]: last message repeated 7 times


Help is much appreciated! Thanks.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

You are on the right path, but you need to look which information is contained in which field. You can look at the property replace doc to see which fields exist. Create a template to see which field is populated by what. I think "pluseaudio" is usually in the syslogtag field while the identifier for "hda-intel" is inside the msg part of the message.

So your filters may need some adjustment, but basically look right. What you now need to do is discard the message once it has been processed. I've just begun to start some doc on how to do that, so I would like to refer you to there so that I can see if the doc actually helps The link is:

http://cookbook.rsyslog.com/node7.html

HTH
Rainer