[rsyslog] Rsyslog expression based filters problem

David Lang david at lang.hm
Tue Jan 31 10:08:10 CET 2017

On Tue, 31 Jan 2017, zalewskig at tlen.pl wrote:

> Hello i have make this filter:     if $fromhost-ip == "" then {     if $programname == "mysql" then       action(type="omfile"
> file="/va     else       action(type="omfile"
> file="/va  }     This work fine but in /var/log/syslog.log  entries shows up
> again, and I do not want it. When I add “& stop” after } rsyslog wont start     What I have wrong?

as you see above, this didn't come through cleanly.

But my guess is that you have multiple filters that match the same log message, 
so the message gets written to all outputs. This is how things are intended to 

If you want to stop processing filters after some condition is matched, you can 
put the 'stop' statement in and no filters afer that point will be processed.

David Lang

More information about the rsyslog mailing list