LinuxQuestions.org - rsyslog put all data to the new file

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - rsyslog put all data to the new file (https://www.linuxquestions.org/questions/linux-newbie-8/rsyslog-put-all-data-to-the-new-file-4175569010/)

rsyslog put all data to the new file

Hello,

In my rsyslog.conf I had:

Code:

$FileOwner user

$FileGroup user

$FileCreateMode 0640

local1.*                                        /opt/log/file1.log



$template LogFile, "/opt/log/log-%msg:R,ERE,1,BLANK:\[]--end:-%.log"

local2.*                                        ?LogFile



$FileOwner user

$FileGroup user

$FileCreateMode 0640

local0.*                                        /opt/log/file0.log



$FileOwner user

$FileGroup user

$FileCreateMode 0640

local3.*                                        /opt/log/file3.log





$FileOwner user

$FileGroup user

$FileCreateMode 0640

local5.*                                        /opt/log/file5.log





$FileOwner user

$FileGroup user

$FileCreateMode 0640

local6.*                                        /opt/log/file6.log

To the bottom I added the following line:

Code:

$FileOwner user

$FileGroup user

$FileCreateMode 0640

local4.*                                        /opt/log/file4.log

So when I restarted the rsyslogd, I got a lot of messages in file4.log, that also located in file3.log.

So why? Is my rsyslog.conf after adding local4.* contains errors?

Quote:

Originally Posted by sluge (Post 5491542)

(..)So why? Is my rsyslog.conf after adding local4.* contains errors?

Using LOCAL[0-9] facility implies you set the facility in only one application and so no filter termination line is needed. I'd first determine which applications all use local4.