How do I prevent remote syslog events from printing locally?
I have a GNU/Linux host that I use to aggregate syslog events from a few switches, printers, and generally less versatile hosts on my LAN.
I set up rsyslog years ago to listen on UDP:514 and save syslog messages it receives from any host to /var/log/netsyslog/${HostNameOrIPHere}.log and that works.
("netsyslog" was my creation)
LogRogate then regularly compresses them and rotates them out. It's delightful.
But sometimes (depending on the "severity level" probably), the remote devices' messages also interrupt me when I'm SSH'd into my linux host. (In the middle of vim is particularly annoying.)
How can I prevent any remote message (regardless of severity) from displaying on local login sessions?
Here's my current config:
==> /etc/rsyslog.conf <==
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$template DynaFile,"/var/log/netsyslog/%HOSTNAME%.log"
*.* -?DynaFile
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
==> /etc/rsyslog.d/listen.conf <==
$SystemLogSocketName /run/systemd/journal/syslog
I'm thinking I want to change: *.emerg :omusrmsg:*
By adding sort of filter to it like localhost.emerg. But I'm not sure how to compose such a filter.
Maybe there's a more elegant way of doing this. I half think perhaps I was wrong to use the same daemon to log locally-originated events as remote ones. I'm open to change.
1 answer
You said rsyslog specifically. Hopefully you are using a version new enough to use the advanced syntax (aka RainerScript). 1
Would something similar to the following work for you?
$EscapeControlCharactersOnReceive off
$template RemoteHost,"/var/log/remote/%HOSTNAME%/application.log"
if ($hostname != 'localhostnamehere') and ($hostname != 'localhost.fqdn') then ?RemoteHost
if ($hostname != 'localhostnamehere') and ($hostname != 'localhost.fqdn') then stop
Followed by whatever else you want. This is from something I wrote for myself in 2016 on CentOS 7. I have no idea if the EscapeControlCharactersOnReceive matters for your situation, but it was part of my template back then.
0 comment threads
2 comment threads