Configuring Rsyslog To Stop The Logging Of Certain Messages

Solution 1:

If you use a recent version of rsyslog (7 for example), you need to do

& stop

after your message. Failing to do so will give you

warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]

Solution 2:

rsyslog needs a statement to stop logging after the match. Add this line immediately after the if statement you already have.

& ~

You may also need to move both statement up in the conf file so that they are parsed before some of the other statements which might be logging them to messages. I change my rsyslog config to look like the following

/etc/rsyslog.conf ($IncludeConfig /etc/rsyslog.d/*.conf)
/etc/rsyslog.d/40-specificdaemon.conf
/etc/rsyslog.d/99-general.conf

This ensures the order I want and makes it easy for config management to push out updates.

Solution 3:

The command is "$stop", not "$ stop". There's a huge difference there.