1

Is there a way that Rsyslog server logs all the messages except smartd messages. I only want "Currently unreadable (pending) sectors" to not get logged.

OmiPenguin
  • 137
  • 1
  • 2
  • 11

1 Answers1

2

Yes, there is. The rule that is logging these messages need to be inside a filter, like this one: (Suppose that smartd messages are being logged in /var/log/smartd.log)

if ($programname == "smartd") then {
  if not ($msg contains "Currently unreadable (pending) sectors") then {
    *.* /var/log/smartd.log
  }
  stop
}

The above code will match all messages that is from smartd service. If the message don't have that string, it'll log all messages in /var/log/smartd.log, but if it contains that string, it won't log. All logs past this point will be dropped by the stop rule.

You can put this piece of code in a file in /etc/rsyslog.d/ ending with .conf, like 01-smartd.conf. As rsyslog.conf loads all files in this directory that ends with .conf, files starting with 00 between 49 will be read first than the default one, 50-default.conf.

Note that with the stop rule in the code, if read first, the messages won't reach the rules in 50-default.conf, so no duplicate messages will exist.

Luiz Guilherme Littig Berger
  • 386
  • 1
  • 4
  • So this one should be rsyslog.conf file ? – OmiPenguin Oct 20 '16 at 06:51
  • 1
    rsyslog.conf loads all files with .conf in this directory, /etc/rsyslog.d/ (I'm using ubuntu server as example). The default rules are defined in 50-default.conf, so you can put this rule there or make a file yourself, like 01-smartd.conf and put this rule into it. Every file that starts with a number between 0 and 49 will be read first than the 50-default.conf. I'll edit my post to clarify things better. – Luiz Guilherme Littig Berger Oct 20 '16 at 17:40