[rsyslog] log *.*, except logs by "postgres"

[david at lang.hm]

On Thu, 18 Mar 2010, Tomasz Chmielewski wrote:

> I have postgres logging to a separate file through rsyslog with this line:
>
> local0.*                -/var/log/postgresql/postgresql_log
>
>
> It gets to /var/log/syslog as well, thanks to this line:
>
> *.*;auth,authpriv.none	-/var/log/syslog
>
>
> As postgres is set to log quite heavily, I would rather not log postgres into /var/log/syslog.
>
> I've read some filtering examples, but I couldn't find one on excluding a given program from a file which is logging everything.
>
> Could anyone point me to a proper example?
>
>
> Postgres adds such entries through syslog:
>
> Mar 19 04:14:16 sun postgres[388]: [261-1] 2010-03-19 04:14:16 SGT LOG:  duration: 0.037 ms  statement: ROLLBACK

you could add

:programname, :isequal, "postgres" ~

ahead of your line to go to /var/log/syslog so that anything with the 
programname of postgres gets dropped first

another thing you could do (if you know that all postgres logs are local0) 
is

local0.* ~

to throw away all logs with facility local0

David Lang