Review Suggested Edit

You can't approve or reject suggested edits because you haven't yet earned the Edit Posts ability.

How do I prevent remote syslog events from printing locally?

I have a GNU/Linux host that I use to aggregate syslog events from a few switches, printers, and generally less versatile hosts on my LAN.
I set up rsyslog years ago to listen on UDP:514 and save syslog messages it receives from any host to `/var/log/netsyslog/${HostNameOrIPHere}.log` and that works.
("netsyslog" was my creation)
LogRogate then regularly compresses them and rotates them out. It's delightful.
But sometimes (depending on the "severity level" probably), the remote devices' messages also interrupt me when I'm SSH'd into my linux host. (In the middle of vim is particularly annoying.)
How can I prevent any remote message (regardless of severity) from displaying on local login sessions?
Here's my current config:
```
==> /etc/rsyslog.conf <==
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$template DynaFile,"/var/log/netsyslog/%HOSTNAME%.log"
*.* -?DynaFile
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
```
```
==> /etc/rsyslog.d/listen.conf <==
$SystemLogSocketName /run/systemd/journal/syslog
```
I'm thinking I want to change: `*.emerg :omusrmsg:*`
By adding sort of filter to it like `localhost.emerg`. But I'm not sure how to compose such a filter.
~~Maybe there's a more elegant way of doing this. I half thing perhaps I was wrong to use the same daemon to log locally-originated events as remote ones. I'm open to change.~~

I have a GNU/Linux host that I use to aggregate syslog events from a few switches, printers, and generally less versatile hosts on my LAN.
I set up rsyslog years ago to listen on UDP:514 and save syslog messages it receives from any host to `/var/log/netsyslog/${HostNameOrIPHere}.log` and that works.
("netsyslog" was my creation)
LogRogate then regularly compresses them and rotates them out. It's delightful.
But sometimes (depending on the "severity level" probably), the remote devices' messages also interrupt me when I'm SSH'd into my linux host. (In the middle of vim is particularly annoying.)
How can I prevent any remote message (regardless of severity) from displaying on local login sessions?
Here's my current config:
```
==> /etc/rsyslog.conf <==
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$template DynaFile,"/var/log/netsyslog/%HOSTNAME%.log"
*.* -?DynaFile
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
```
```
==> /etc/rsyslog.d/listen.conf <==
$SystemLogSocketName /run/systemd/journal/syslog
```
I'm thinking I want to change: `*.emerg :omusrmsg:*`
By adding sort of filter to it like `localhost.emerg`. But I'm not sure how to compose such a filter.
Maybe there's a more elegant way of doing this. I half think perhaps I was wrong to use the same daemon to log locally-originated events as remote ones. I'm open to change.

rsyslog syslog logging

Communities

Review Suggested Edit