基本rsyslog配置

Question

I have program logging to Syslog and I want to split those messages out into separate files.

I want all messages generated by MyApp to go to /var/log/my_app.log , and anything warn or more serious to also go to /var/log/my_app.err .

I don't want the messages to end up in /var/log/syslog , as they do at the moment.

I have created a new rsyslog conf file /etc/rsyslog.d/10-my_app.conf in which I have:

if $programname == 'MyApp'
then
{
        if $pri <= 4
        then
        {
                /var/log/my_app.err
        }

        /var/log/my_app.log
        & stop
}

But it's only partially working. All messages end up in my_app.log , half of the messages still appear in syslog & nothing appears in my_app.err

Answer 1

I found a solution:

if $programname == 'MyApp'
then
{
    *.warning /var/log/my_app.err
    *.* /var/log/my_app.log
    & stop
}

Half of the problem was that my config file was getting loaded after another file which was logging my lines to /var/log/syslog before I had a chance to drop them, so I needed to change some file names to fix that.