Bsrgvty

Printing the bits of an integer using bitfields and union

SD Card speed degrading and doesn't work on one of my cameras: can I do something?

Fermat's Last Theorem, mod n

How to get the address of a C++ lambda function within itself?

How much money is needed to prove you can support yourself with ESTA

Should I take a 7 month stint at a company off of my resume?

How do the Martian rebels defeat Earth when they're grossly outnumbered and outgunned?

Check if cell text has a specific format

Check the validity of a 10-digit telephone number

My name causes an issue with any booking! (names end with MR and MRS)

Bash to check if directory exist. If not create with an array

Multiple premoves

What would make the internet go away?

What on earth is this small wall-mounted computer?

Need Good OOP Design For World and Countries Problem

Is current (November 2019) polling about Democrats lead over Trump trustworthy?

How to avoid answering "what were you sick with"?

What (if anything) could have caused all three shuttle main engines to stop at the same time?

Possible executive assistant job scam

Well-known American figure with Roman numerals

HR trying to sabotage my wife's work because we're married

Hot Glue Gun NTC Heating Element?

'Nuke the sky' to make a rocket launch a tiny bit easier

Could the Ancient Egyptian hieroglyphs have been deciphered without the Rosetta Stone with modern tech?

Syslog still receiving entries after filter to sepaqrate file

Rsyslog channels change ownership from rootRsyslog not forwarding specific log file to remote serveroverriding default syslog behaviorWhat would cause /var/log/syslog to only be written to when executing rsyslog -d?rsyslog server saves logs from remote also in /var/syslogrsyslogd wont start correctly on Ubuntu 14.04.4 LTS while using the Init-ScriptHow to stop Dovecot from logging to syslog

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;

1

1

I am trying to get remote devices to into separate log files and not in the main syslog file.

I have created a filter for remote devices to go to a separate file per host, but still remote devices log contents end up in main syslog. I've tried both & ~ and & stop.

Common problem but can't find a working answer. rsyslog 5.8.6 (Ubuntu 12 LTS)

/etc/rsyslog.d/20-external.conf:

$template PerHostLog,"/var/log/external/%HOSTNAME%.log"
if $fromhost-ip != '127.0.0.1' then -?PerHostLog
#& ~
& stop

All other files are the same, except for changes to /etc/rsyslog.conf to enable remote logging.

My files per host do have contents, but they are also still coming into the main syslog file.

Whats the best way to adjust either configuration or filter to make sure they stay in the separate files, and not in the syslog file.

Any ideas what I'm doing wrong?

12.04 server syslog rsyslog

share|improve this question

edited Jul 20 at 18:01

Kevin Bowen

16.1k1515 gold badges6262 silver badges7373 bronze badges

asked Aug 27 '15 at 7:06

TimLTimL

844 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I don't suppose you've tried &~ (no space) rather than & ~?
  
  – Ken Sharp
  Dec 17 '15 at 13:20
  
  

  
  
  
  

add a comment
 | 

1

1

I am trying to get remote devices to into separate log files and not in the main syslog file.

I have created a filter for remote devices to go to a separate file per host, but still remote devices log contents end up in main syslog. I've tried both & ~ and & stop.

Common problem but can't find a working answer. rsyslog 5.8.6 (Ubuntu 12 LTS)

/etc/rsyslog.d/20-external.conf:

$template PerHostLog,"/var/log/external/%HOSTNAME%.log"
if $fromhost-ip != '127.0.0.1' then -?PerHostLog
#& ~
& stop

All other files are the same, except for changes to /etc/rsyslog.conf to enable remote logging.

My files per host do have contents, but they are also still coming into the main syslog file.

Whats the best way to adjust either configuration or filter to make sure they stay in the separate files, and not in the syslog file.

Any ideas what I'm doing wrong?

12.04 server syslog rsyslog

share|improve this question

edited Jul 20 at 18:01

Kevin Bowen

16.1k1515 gold badges6262 silver badges7373 bronze badges

asked Aug 27 '15 at 7:06

TimLTimL

844 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I don't suppose you've tried &~ (no space) rather than & ~?
  
  – Ken Sharp
  Dec 17 '15 at 13:20
  
  

  
  
  
  

add a comment
 | 

I am trying to get remote devices to into separate log files and not in the main syslog file.

I have created a filter for remote devices to go to a separate file per host, but still remote devices log contents end up in main syslog. I've tried both & ~ and & stop.

Common problem but can't find a working answer. rsyslog 5.8.6 (Ubuntu 12 LTS)

/etc/rsyslog.d/20-external.conf:

$template PerHostLog,"/var/log/external/%HOSTNAME%.log"
if $fromhost-ip != '127.0.0.1' then -?PerHostLog
#& ~
& stop

All other files are the same, except for changes to /etc/rsyslog.conf to enable remote logging.

My files per host do have contents, but they are also still coming into the main syslog file.

Whats the best way to adjust either configuration or filter to make sure they stay in the separate files, and not in the syslog file.

Any ideas what I'm doing wrong?

12.04 server syslog rsyslog

share|improve this question

edited Jul 20 at 18:01

Kevin Bowen

16.1k1515 gold badges6262 silver badges7373 bronze badges

asked Aug 27 '15 at 7:06

TimLTimL

844 bronze badges

$template PerHostLog,"/var/log/external/%HOSTNAME%.log"
if $fromhost-ip != '127.0.0.1' then -?PerHostLog
#& ~
& stop

share|improve this question

edited Jul 20 at 18:01

Kevin Bowen

16.1k1515 gold badges6262 silver badges7373 bronze badges

asked Aug 27 '15 at 7:06

TimLTimL

844 bronze badges

share|improve this question

edited Jul 20 at 18:01

Kevin Bowen

16.1k1515 gold badges6262 silver badges7373 bronze badges

asked Aug 27 '15 at 7:06

TimLTimL

844 bronze badges

edited Jul 20 at 18:01

Kevin Bowen

16.1k1515 gold badges6262 silver badges7373 bronze badges

edited Jul 20 at 18:01

Kevin Bowen

16.1k1515 gold badges6262 silver badges7373 bronze badges

asked Aug 27 '15 at 7:06

TimLTimL

844 bronze badges

asked Aug 27 '15 at 7:06

TimLTimL

844 bronze badges

2 Answers
2

active

oldest

votes

0

Put both conditions on separate lines:


if $fromhost-ip != '127.0.0.1' then -?PerHostLog

if $fromhost-ip != '127.0.0.1' then stop

share|improve this answer

edited Feb 24 '16 at 12:20

answered Feb 24 '16 at 11:27

meerameera

1633 bronze badges

add a comment
 | 

0

If your filters working you could edit your /etc/rsyslog.conf to stop duplicates as per this thread:

https://serverfault.com/questions/711708/stop-crontab-from-filling-syslog-ubuntu-15-04/717244#717244

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Sep 7 '15 at 13:38

Ek0n0m1kEk0n0m1k

1333 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This is on the right track expect I don't know which facility external syslog messages come under.
  
  – TimL
  Sep 24 '15 at 2:13
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This link shows you a list of syslog facilities as well as a method of monitoring the actual messages on your system to see what codes are in use fir3net.com/UNIX/Linux/…
  
  – Ek0n0m1k
  Nov 12 '15 at 17:59
  

  
  
  
  

add a comment
 | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f666325%2fsyslog-still-receiving-entries-after-filter-to-sepaqrate-file%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

Put both conditions on separate lines:


if $fromhost-ip != '127.0.0.1' then -?PerHostLog

if $fromhost-ip != '127.0.0.1' then stop

share|improve this answer

edited Feb 24 '16 at 12:20

answered Feb 24 '16 at 11:27

meerameera

1633 bronze badges

add a comment
 | 

0

Put both conditions on separate lines:


if $fromhost-ip != '127.0.0.1' then -?PerHostLog

if $fromhost-ip != '127.0.0.1' then stop

share|improve this answer

edited Feb 24 '16 at 12:20

answered Feb 24 '16 at 11:27

meerameera

1633 bronze badges

add a comment
 | 

Put both conditions on separate lines:


if $fromhost-ip != '127.0.0.1' then -?PerHostLog

if $fromhost-ip != '127.0.0.1' then stop

share|improve this answer

edited Feb 24 '16 at 12:20

answered Feb 24 '16 at 11:27

meerameera

1633 bronze badges

share|improve this answer

edited Feb 24 '16 at 12:20

answered Feb 24 '16 at 11:27

meerameera

1633 bronze badges

answered Feb 24 '16 at 11:27

meerameera

1633 bronze badges

answered Feb 24 '16 at 11:27

meerameera

1633 bronze badges

0

If your filters working you could edit your /etc/rsyslog.conf to stop duplicates as per this thread:

https://serverfault.com/questions/711708/stop-crontab-from-filling-syslog-ubuntu-15-04/717244#717244

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Sep 7 '15 at 13:38

Ek0n0m1kEk0n0m1k

1333 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This is on the right track expect I don't know which facility external syslog messages come under.
  
  – TimL
  Sep 24 '15 at 2:13
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This link shows you a list of syslog facilities as well as a method of monitoring the actual messages on your system to see what codes are in use fir3net.com/UNIX/Linux/…
  
  – Ek0n0m1k
  Nov 12 '15 at 17:59
  

  
  
  
  

add a comment
 | 

0

If your filters working you could edit your /etc/rsyslog.conf to stop duplicates as per this thread:

https://serverfault.com/questions/711708/stop-crontab-from-filling-syslog-ubuntu-15-04/717244#717244

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Sep 7 '15 at 13:38

Ek0n0m1kEk0n0m1k

1333 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This is on the right track expect I don't know which facility external syslog messages come under.
  
  – TimL
  Sep 24 '15 at 2:13
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This link shows you a list of syslog facilities as well as a method of monitoring the actual messages on your system to see what codes are in use fir3net.com/UNIX/Linux/…
  
  – Ek0n0m1k
  Nov 12 '15 at 17:59
  

  
  
  
  

add a comment
 | 

If your filters working you could edit your /etc/rsyslog.conf to stop duplicates as per this thread:

https://serverfault.com/questions/711708/stop-crontab-from-filling-syslog-ubuntu-15-04/717244#717244

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Sep 7 '15 at 13:38

Ek0n0m1kEk0n0m1k

1333 bronze badges

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Sep 7 '15 at 13:38

Ek0n0m1kEk0n0m1k

1333 bronze badges

edited Apr 13 '17 at 12:14

Community♦

1

edited Apr 13 '17 at 12:14

Community♦

1

answered Sep 7 '15 at 13:38

Ek0n0m1kEk0n0m1k

1333 bronze badges

answered Sep 7 '15 at 13:38

Ek0n0m1kEk0n0m1k

1333 bronze badges