Custom Rsyslog filters

Mon 08 December 2014
By alex

Rsyslog has the ability to filter messages by pattern matching properties within a message.

:[property], [!][compare type], "[string]"

So to match all proftpd logs and send them to a specific file, we can search the app-name property for proftpd

:app-name, isequal, "proftpd"   /var/log/proftpd/proftpd.log

That would be placed above the typical catch all rule and the ~ will cause all matched messages to be discarded so they aren't processed again and sent to other logfiles.

:msg, contains, "error"     /var/log/errors.log
:app-name, isequal, "sudo"  /var/log/sudo.log

These examples should be fairly obvious. See the rsyslog documentation for more information about properties and comparison operators