[rsyslog-notify] Forum Thread: Re: Help with logs. Filling up and taking up space - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25615#p25615

Message: 
----------
*.warn matches everything of severity warn or worse *.=warn only matches
warn, not error, crit, etc.

moving the database output ahead of the file output is required, but not
enough. Unless you tell rsyslog to stop processing a message, it will keep
going through the rules and output to anything that matches.

so on current versions you can do
local7.warn {
 output to database
 stop
}

on older versions you would have to do
local7.warn output to database
& ~

the & says "use the same criteria as the last action
the ~ is the same as stop (don't try to match anything else in this or
included files against this log message)