I have a GNU/Linux host that I use to aggregate syslog events from a few switches, printers, and generally less versatile hosts on my LAN.

I set up rsyslog years ago to listen on UDP:514 and save syslog messages it receives from any host to /var/log/netsyslog/${HostNameOrIPHere}.log and that works.
("netsyslog" was my creation) LogRogate then regularly compresses them and rotates them out. It's delightful.

But sometimes (depending on the "severity level" probably), the remote devices' messages also interrupt me when I'm SSH'd into my linux host. (In the middle of vim is particularly annoying.)

How can I prevent any remote message (regardless of severity) from displaying on local login sessions?

Here's my current config:

==> /etc/rsyslog.conf <==
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$template DynaFile,"/var/log/netsyslog/%HOSTNAME%.log"
*.* -?DynaFile
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.*      /var/log/secure
mail.*         -/var/log/maillog
cron.*          /var/log/cron
*.emerg         :omusrmsg:*
uucp,news.crit  /var/log/spooler
local7.*        /var/log/boot.log

==> /etc/rsyslog.d/listen.conf <==
$SystemLogSocketName /run/systemd/journal/syslog

I'm thinking I want to change: *.emerg :omusrmsg:* By adding sort of filter to it like localhost.emerg. But I'm not sure how to compose such a filter.

Maybe there's a more elegant way of doing this. I half think perhaps I was wrong to use the same daemon to log locally-originated events as remote ones. I'm open to change.

posted almost 3 years ago

CC BY-SA 4.0

3y ago by CodeFarmer‭

re89j‭

71 reputation 6 3 15 4