rsyslog does not discard messages

Solution 1:

I was thinking the hostname is "default" and the :msg is "send string", but I couldn't get it to filter that way either. So, I did some more searching and found the following:

:rawmsg, isequal, "default send string" stop

That finally made the messages go away. For what its worth, they appear to be from our load balancer, probably a syslog/udp healthcheck.

Reference: http://lists.adiscon.net/pipermail/rsyslog/2012-September/030562.html

Solution 2:

You need to make sure that your rule for discarding the message should be called before the one that writes it in a file.

By default, Rsyslog have a /etc/rsyslog.d/50-default.conf that writes messages as it is. Maybe putting your rule before:

$IncludeConfig /etc/rsyslog.d/*.conf

should work.

And Rsyslog warns to not use ~, you should use stop instead.