我有以下rsyslog.conf：
$PreserveFQDN on # rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html #### MODULES #### $ModLoad imuxsock # provides support for local system logging (eg via logger command) $ModLoad imklog # provides kernel logging support (previously done by rklogd) #$ModLoad immark # provides --MARK-- message capability # Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514 # Provides TCP syslog reception $ModLoad imtcp $InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf #### RULES #### #discard loadbalancer messages :msg, contains, "default send string" ~ # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log # ### begin forwarding rule ### # The statement between the begin ... end define a SINGLE forwarding # rule. They belong together, do NOT split them. If you create multiple # forwarding rules, duplicate the whole block! # Remote Logging (we use TCP for reliable delivery) # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory /var/lib/rsyslog # where to place spool files #$ActionQueueFileName fwdRule1 # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, eg 192.168.0.1:514, port optional #*.* @@remote-host:514 # *.* @localhost:5000 # ### end of the forwarding rule ### 其中包含以下用于放弃特定消息的规则：
#discard loadbalancer messages :msg, contains, "default send string" ~
它似乎没有做它应该做的，我仍然可以在/ var / log / messages中看到这些消息：
[~] # tail -f /var/log/messages Dec 3 02:51:38 default send string Dec 3 02:51:42 default send string Dec 3 02:51:43 default send string Dec 3 02:51:47 default send string Dec 3 02:51:48 default send string Dec 3 02:51:52 default send string Dec 3 02:51:53 default send string Dec 3 02:51:57 default send string Dec 3 02:51:58 default send string Dec 3 02:52:02 default send string Dec 3 02:52:03 default send string
请注意，这是一个Logstash服务器，它接收来自其他服务器的端口514的系统日志消息，并将它们转发到它自己的端口5000，以便Logstash处理它们，这就是为什么在configuration文件中有这一行：
*.* @localhost:5000
我在想hostname是“默认”和:msg是“发送string”，但我不能让它来过滤这种方式。 所以，我做了一些更多的search，发现以下内容：
:rawmsg, isequal, "default send string" stop
这最终使消息消失。 对于它的价值，它们似乎来自我们的负载平衡器，可能是一个syslog / udp健康检查。
参考： http ： //lists.adiscon.net/pipermail/rsyslog/2012-September/030562.html
您需要确保放弃该消息的规则应在将其写入文件之前调用。
默认情况下，Rsyslog具有/etc/rsyslog.d/50-default.conf，可以按照原样写入消息。 也许把你的规则放在前面：
$IncludeConfig /etc/rsyslog.d/*.conf
应该pipe用。
而Rsyslog警告不要使用〜，你应该使用stop 。