这已经在其他职位已经解决，但我仍然无法得到这个工作正常。
我正在尝试OMIT（放弃）写入我的“ /var/log/secure ”的某些条目。
也就是说，任何包含某些可信IP地址的行，在本例中为“ IP = 10.10.10.10 ”。
根据我的理解，使用像这样的REGEXexpression式应该可以做到这一点，但是我认为我在文件中存在一个放置问题：
if $syslogfacility-text == 'authpriv' and $msg !contains '10.10.10.10' then /var/log/secure &~
以下是我在/etc/rsyslog.conf文件中尝试过的内容：
#rsyslog v3configuration文件
# if you experience problems, check # http://www.rsyslog.com/troubleshoot for assistance #### MODULES #### $ModLoad imuxsock.so # provides support for local system logging (eg via logger command) $ModLoad imklog.so # provides kernel logging support (previously done by rklogd) #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat #### RULES #### if $syslogfacility-text == 'authpriv' and $msg !contains '10.10.10.10' then /var/log/secure &~ # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure
rsyslog.conf文件的另一个细微变化如下，因为我读过这个规则出现的顺序是有差别的：
#rsyslog v3 config file # if you experience problems, check # http://www.rsyslog.com/troubleshoot for assistance #### MODULES #### $ModLoad imuxsock.so # provides support for local system logging (eg via logger command) $ModLoad imklog.so # provides kernel logging support (previously done by rklogd) #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat #### RULES #### if $syslogfacility-text == 'authpriv' and $msg !contains '10.10.10.10' then /var/log/secure &~ # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure if $syslogfacility-text == 'authpriv' and $msg !contains '10.10.10.10' then /var/log/secure &~
我已经尝试了很多其他的方式，但不想污染这个post太多的变化。
另一个重要的点是，我需要确保通过rsyslog其他日志文件整个系统STILL跟踪这个IP地址，但是。
所以从本质上讲，只要OMIT从“ /var/log/secure ”中包含“ 10.10.10.10 ”