Getting Syslog to log to both syslog and custom log file

DJacobson

12/12/22, 2:46 PM

In syslog (Raspbian rsyslog swVersion="8.1901.0"),

I am trying to match / filter a system msg containing a specific string BOTH to /var/log/syslog (default) AND to a custom separate log file, i.e.: /var/log/nut.log.

I have been able to achieve the by placing the following filter lines in /etc/rsyslog.conf:

# NUT logging: Include USB msgs since montoring UPS via only USB
:msg,contains,"USB" /var/log/nut.log
& stop
:msg,contains,"nut-" /var/log/nut.log
& stop

The & stop is needed to halt the filters once a match is made. I believe the preferred method is to place this in a dedicated file, i.e.: /etc/rsyslog.d/0-nut.conf

But, when I do that, the filters stop logging to /var/log/syslog, and exclusively log to /var/log/nut.log... ?

Is there a different way to do this?

Thx!

312

1 + 2

linux

logging

syslog

rsyslog

raspbian

meuh

12/12/22, 5:04 PM

Do you need the `& stop`? Do you have msgs with both "USB" and "nut-" that will get logged twice?

DJacobson

12/12/22, 5:57 PM

@meuh That was indeed my problem and your answer below was perfect.

Score:0

Server

meuh

12/12/22, 5:25 PM

The $IncludeConfig or include() directive in rsyslog.conf appears before most of the standard rules, including the one that writes messages to /var/log/syslog. If you add your rules after the other rules in this file, then the nut messages will have already been written to syslog before it is also matched and written to nut.log.

If instead you put your rules in a separate file, the message will be written to nut.log, then the stop will skip the later rules. The answer is not to use stop.

If the problem is that a message might contain both "USB" and "nut-", and so be written twice to nut.log, then you need to use a more sophisticated syntax.

The legacy syntax was replaced by RainerScript a long time ago. It means you can write filters like:

if ($msg contains "USB" or $msg contains "nut-") then {
   action(type="omfile" file="/var/log/nut.log")
}

This does not need to prevent further processing of the message.

0 + 1

DJacobson

12/12/22, 6:15 PM

Thank you. I learned a lot about the order of Rsyslog processing in your concise answer. I was indeed trying to avoid duplicated log msgs.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Getting Syslog to log to both syslog and custom log file

TH: รับ Syslog เพื่อเข้าสู่ระบบทั้ง syslog และไฟล์บันทึกที่กำหนดเอง

RO: Obținerea ca Syslog să se înregistreze atât în fișierul jurnal personalizat, cât și în syslog

RU: Получение Syslog для регистрации как в системном журнале, так и в пользовательском файле журнала

VI: Nhận Syslog để đăng nhập vào cả nhật ký hệ thống và tệp nhật ký tùy chỉnh

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.