Monday, January 19, 2015

stop polluting syslog

so yeah, local6 is pretty awesome. it will write and write and write to the local system. but, i like to have it reserved for super secret stuff, you know? and all that writing takes up space. here's a clue. to not log local6 to the local system and to forward it along, edit two lines:
*.*;auth,authpriv.none,local6.none       -/var/log/syslog
auth,authpriv.*;local5.*;local6.*        @remotesyslog
the deal with the dash in an rsyslog file is that after writing, the file does not sync.
and the .none means no no do not log no no. as opposed to asterisk which means yes please all.
fun for me. fun for you.

No comments: