10

I have a cluster of Linux servers that are fronted by a load-balancer, which probes each server every 5 seconds to determine if it's operational. These probes generate a lot of useless noise in the logs, and I'd like to simply not have them logged...

Is there a way to prevent rsyslog from logging specific events?

gharper
  • 5,425
  • 4
  • 29
  • 35

3 Answers3

14

Check out the rsyslog filter documentation. Here is an example from the docs on how to filter a message. The filter would need to be place in the configuration file before the section that defines the log where the annoying message is being delivered too.

:msg, contains, "informational"  ~

All messages containing the string "informational" are discarded.

Zoredache
  • 130,897
  • 41
  • 276
  • 420
  • Update 2021: my version of rsyslog (8.24.0) complains "warning: ~ action is deprecated, consider using the 'stop' statement instead" and that works fine. – chrisinmtown Jun 14 '21 at 13:13
3

It might be easier to configure those specific entries to go to some other file that is either rotated more often, or maybe even (if you really don't care about the output), /dev/null

If you can't use normal syslog facility filtering, try checking the expression-based filters: http://www.rsyslog.com/doc-rsyslog_conf_filter.html

Matt Simmons
  • 20,396
  • 10
  • 68
  • 116
0

Also consider taking a look at swatch, which let's you customize, colorize and filter log viewing.

Joel K
  • 5,853
  • 2
  • 30
  • 34