0

I have the following config in a systemd service:

StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=udocit

And this rsyslog conf file:

if $programname == 'udocit' and $syslogseverity > 5 then {
  action(
    type="omfile"
    FileCreateMode="0640"
    File="/var/log/udocit.log"
  )
& stop
}

if $programname == 'udocit' and $syslogseverity <= 5 then {
  action(
    type="omfile"
    FileCreateMode="0640"
    File="/var/log/udocit.err"
  )
& stop
}

The service starts a nodejs app.

I would expect that messages which come from the console.error() function, which outputs to stderr, would go to the udocit.err file with this config, but all messages are instead written to the udocit.log file.

What am I doing wrong here?

HomeIsWhereThePcIs
  • 144
  • 1
  • 2
  • 9
  • Note, you don't need the `&` before `stop`, as that is used to match a legacy-style filter. In Rainerscript, you are inside a `then` clause, so it is clear what is meant. – meuh Mar 12 '21 at 17:42

1 Answers1

1

I don't know what console.error() might do, but systemd will make all messages written to stdout or stderr generate a syslog entry with a default level of info (SyslogLevel=info).

To get a different level the lines printed must begin with a string such as <3> which is level error. Systemd, by default, removes such a prefix and converts the syslog entry severity to it. See man systemd.exec for option SyslogLevelPrefix and man sd-daemon.

meuh
  • 1,563
  • 10
  • 11
  • Is there a similar prefix I can use with journald? I am trying to do this from a podman container logging to journald. Then in rsyslog I catch the container logs and log them to a file, but I get the <3> outputted and log severity is INFO – HomeIsWhereThePcIs Mar 19 '21 at 11:33
  • Sorry, I don't know much about journald, and nothing about podman. You should probably post a new question. – meuh Mar 19 '21 at 12:09