rsyslog: send logs to different file using custom template
So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log.
Since it is a Java app with its own log format, I don't want to have timestamps or anything on it, just the message itself.
What I have so far is this:
[Unit]
Description=My App
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=myapp
ExecStart=/usr/bin/java -jar /opt/app.jar
Restart=on-failure
[Install]
WantedBy=multi-user.target
And then I have thet /etc/rsyslog.d/myapp.conf file:
template(name="clean" type="string" string="%msg:2:$:drop-last-lf%n")
if $programname == 'myapp' then action(type="omfile" file="/var/log/app.log" template="clean")
& stop
If I understand this correctly, if the program name is myapp, it should use the clean template and save the logs to /var/log/app.log and then stop.
That works, except that it also sends the logs to /var/log/syslog.
How can I prevent it to save these logs to syslog too?
systemd syslog rsyslog
asked Dec 18 at 14:22
caarlos0
1335
add a comment |
So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log.
Since it is a Java app with its own log format, I don't want to have timestamps or anything on it, just the message itself.
What I have so far is this:
[Unit]
Description=My App
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=myapp
ExecStart=/usr/bin/java -jar /opt/app.jar
Restart=on-failure
[Install]
WantedBy=multi-user.target
And then I have thet /etc/rsyslog.d/myapp.conf file:
template(name="clean" type="string" string="%msg:2:$:drop-last-lf%n")
if $programname == 'myapp' then action(type="omfile" file="/var/log/app.log" template="clean")
& stop
If I understand this correctly, if the program name is myapp, it should use the clean template and save the logs to /var/log/app.log and then stop.
That works, except that it also sends the logs to /var/log/syslog.
How can I prevent it to save these logs to syslog too?
systemd syslog rsyslog
asked Dec 18 at 14:22
caarlos0
1335
add a comment |
So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log.
Since it is a Java app with its own log format, I don't want to have timestamps or anything on it, just the message itself.
What I have so far is this:
[Unit]
Description=My App
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=myapp
ExecStart=/usr/bin/java -jar /opt/app.jar
Restart=on-failure
[Install]
WantedBy=multi-user.target
And then I have thet /etc/rsyslog.d/myapp.conf file:
template(name="clean" type="string" string="%msg:2:$:drop-last-lf%n")
if $programname == 'myapp' then action(type="omfile" file="/var/log/app.log" template="clean")
& stop
If I understand this correctly, if the program name is myapp, it should use the clean template and save the logs to /var/log/app.log and then stop.
That works, except that it also sends the logs to /var/log/syslog.
How can I prevent it to save these logs to syslog too?
systemd syslog rsyslog
asked Dec 18 at 14:22
caarlos0
1335
So, I'm using systemd to send the logs to rsyslog, and I want to write the logs to /var/log/app.log.
Since it is a Java app with its own log format, I don't want to have timestamps or anything on it, just the message itself.
What I have so far is this:
[Unit]
Description=My App
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=myapp
ExecStart=/usr/bin/java -jar /opt/app.jar
Restart=on-failure
[Install]
WantedBy=multi-user.target
And then I have thet /etc/rsyslog.d/myapp.conf file:
template(name="clean" type="string" string="%msg:2:$:drop-last-lf%n")
if $programname == 'myapp' then action(type="omfile" file="/var/log/app.log" template="clean")
& stop
If I understand this correctly, if the program name is myapp, it should use the clean template and save the logs to /var/log/app.log and then stop.
That works, except that it also sends the logs to /var/log/syslog.
How can I prevent it to save these logs to syslog too?
systemd syslog rsyslog
systemd syslog rsyslog
asked Dec 18 at 14:22
caarlos0
1335
asked Dec 18 at 14:22
caarlos0
1335
asked Dec 18 at 14:22
caarlos0
1335
asked Dec 18 at 14:22
caarlos0
1335
asked Dec 18 at 14:22
caarlos0
1335
1335
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
The issue was that the default config file was called 50-defaults.conf, so it was processed first...
That means that logs were being sent to /var/log/syslog as per defaults config, and then it goes through my config file, which does the stop, but it didn't matter because there was nothing after it.
Renaming it to 10-myapp.conf fixes the issue.
answered Dec 18 at 15:24
caarlos0
1335
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489698%2frsyslog-send-logs-to-different-file-using-custom-template%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The issue was that the default config file was called 50-defaults.conf, so it was processed first...
That means that logs were being sent to /var/log/syslog as per defaults config, and then it goes through my config file, which does the stop, but it didn't matter because there was nothing after it.
Renaming it to 10-myapp.conf fixes the issue.
answered Dec 18 at 15:24
caarlos0
1335
add a comment |
The issue was that the default config file was called 50-defaults.conf, so it was processed first...
That means that logs were being sent to /var/log/syslog as per defaults config, and then it goes through my config file, which does the stop, but it didn't matter because there was nothing after it.
Renaming it to 10-myapp.conf fixes the issue.
answered Dec 18 at 15:24
caarlos0
1335
add a comment |
The issue was that the default config file was called 50-defaults.conf, so it was processed first...
That means that logs were being sent to /var/log/syslog as per defaults config, and then it goes through my config file, which does the stop, but it didn't matter because there was nothing after it.
Renaming it to 10-myapp.conf fixes the issue.
answered Dec 18 at 15:24
caarlos0
1335
The issue was that the default config file was called 50-defaults.conf, so it was processed first...
That means that logs were being sent to /var/log/syslog as per defaults config, and then it goes through my config file, which does the stop, but it didn't matter because there was nothing after it.
Renaming it to 10-myapp.conf fixes the issue.
answered Dec 18 at 15:24
caarlos0
1335
answered Dec 18 at 15:24
caarlos0
1335
answered Dec 18 at 15:24
caarlos0
1335
answered Dec 18 at 15:24
caarlos0
1335
1335
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489698%2frsyslog-send-logs-to-different-file-using-custom-template%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
