rsyslog put all data to the new file

sluge · 02-02-2016, 07:58 AM

Hello,

In my rsyslog.conf I had:

Code:

$FileOwner user
$FileGroup user
$FileCreateMode 0640
local1.*                                         /opt/log/file1.log

$template LogFile, "/opt/log/log-%msg:R,ERE,1,BLANK:\[]--end:-%.log"
local2.*                                         ?LogFile

$FileOwner user
$FileGroup user
$FileCreateMode 0640
local0.*                                         /opt/log/file0.log

$FileOwner user
$FileGroup user
$FileCreateMode 0640
local3.*                                         /opt/log/file3.log


$FileOwner user
$FileGroup user
$FileCreateMode 0640
local5.*                                         /opt/log/file5.log


$FileOwner user
$FileGroup user
$FileCreateMode 0640
local6.*                                         /opt/log/file6.log

To the bottom I added the following line:

Code:

$FileOwner user
$FileGroup user
$FileCreateMode 0640
local4.*                                         /opt/log/file4.log

So when I restarted the rsyslogd, I got a lot of messages in file4.log, that also located in file3.log.

So why? Is my rsyslog.conf after adding local4.* contains errors?

unSpawn · 02-02-2016, 12:55 PM

Quote:

Originally Posted by sluge

(..)So why? Is my rsyslog.conf after adding local4.* contains errors?

Using LOCAL[0-9] facility implies you set the facility in only one application and so no filter termination line is needed. I'd first determine which applications all use local4.