Cfrtjryk

I get duplication on a remote rsyslog server:
Even though I've configured a catch for clamav logs from mail servers - I still get the logs appearing in syslog

# Configuration for Mail ClamAV logs in rsyslog.d

if ($fromhost contains "mail") and ($programname contains "clam") then {

   action(type="omfile" file="/var/log/mail-clam.log")

}

mail-clam.log:

Jan  3 11:32:07 mail2 freshclam[265]: Received signal: wake up

Jan  3 11:32:07 mail2 freshclam[265]: ClamAV update process started at Thu Jan  3 11:32:07 2019

Jan  3 11:32:07 mail2 freshclam[265]: main.cld is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)

Jan  3 11:32:07 mail2 freshclam[265]: daily.cld is up to date (version: 25264, sigs: 2197013, f-level: 63, builder: raynman)

Jan  3 11:32:07 mail2 freshclam[265]: bytecode.cld is up to date (version: 328, sigs: 94, f-level: 63, builder: neo)

syslog:

Jan  3 11:32:07 mail2 freshclam[265]: Received signal: wake up

Jan  3 11:32:07 mail2 freshclam[265]: ClamAV update process started at Thu Jan  3 11:32:07 2019

Jan  3 11:32:07 mail2 freshclam[265]: main.cld is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)

Jan  3 11:32:07 mail2 freshclam[265]: daily.cld is up to date (version: 25264, sigs: 2197013, f-level: 63, builder: raynman)

Jan  3 11:32:07 mail2 freshclam[265]: bytecode.cld is up to date (version: 328, sigs: 94, f-level: 63, builder: neo)

I've got the following line exluding logs in rsyslog.conf:

*.*;auth,authpriv,mail.none     -/var/log/syslog

I'm not sure how to exlude $programname from syslog? What would be the correct way to approach this?

*.*;auth,authpriv,mail.none,if ($programname contains "clam") then {}     -/var/log/syslog

Or can reference the if statement somehow?

The rules in the rsyslog configuration file are evaluated from top to bottom. So, you can achieve selective logging by simply dropping the log message after the necessary processing. The 'stop' action is used to discard the log message.

In your case, modify your rsyslog.conf file to this:

if ($fromhost contains "mail") and ($programname contains "clam") then {

   action(type="omfile" file="/var/log/mail-clam.log")

   stop

}



...



*.*;auth,authpriv,mail.none     -/var/log/syslog

With this configuration, all messages that match the expression are logged to /var/log/mail-clam.log and then discarded. This will prevent these messages from being processed further, and therefore being logged to /var/log/syslog.