Ask A Question


[Rsyslog] How to avoid duplicate of logs from a file into /var/log/syslog

Posted by Pierre Guceski about a year ago

Find the following line in /etc/rsyslog.d/50-default.conf

*.*;auth,authpriv.none -/var/log/syslog

Change it into:

if not ($syslogtag=="your_file_tag" ) then -/var/log/syslog

Where your_file_tag is the $InputFileTag var you set into your input file module

If you are forwarding multiple file, you can change this line into :

if not ($syslogtag=="your_file_tag_1" ) and not ($syslogtag=="your_file_tag_2" ) and not (...) then -/var/log/syslog
Loading comments...