Is there any way to exclude specific entries from Linux log files?
Specifically, I'm trying to keep a nice clean cron.log under Ubuntu Server (hardy LTS). In addition to the 4 or 5 cron jobs that come pre-installed, I've added 4 of my own jobs (using the cron.d method). Now, one of the automatically installed jobs is the PHP session expiration script that runs every hour.
It needs to be executed, sure, but frankly I don't care about when it executes. It runs every hour and outputs an entry similar to the one below.
Oct 18 02:17:01 cobalt /USR/SBIN/CRON[18160]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
Oct 18 02:39:01 cobalt /USR/SBIN/CRON[18233]: (root) CMD ( [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -r -0 rm)
Since this executes every single hour and produces a comparatively lengthy log entry, it accounts for 90% of my cron.log. If I'm thumbing through the log file to make sure my daily backup scripts and such got executed, they get swallowed by all these entries.
Is there any way for me to exclude this process from being logged?
I realize that I can use grep or a log reader program to search through, but that isn't really what I'm looking for. I'd like to just be able to "cat cron.log | less" and thumb through without log spam from processes I don't care about (and I also realize that this process would be important on most web servers, but this isn't primarily a webserver and doesn't even allow connection from outside the company).
Solution 1:
Any recent syslog-daemon (like syslog-ng or rsyslog) supports filter-functionality. Just edit your rsyslog.conf or syslog-ng-conf to ignore entries for the process name /USR/SBIN/CRON which contain the string CMD.
Even better: you just log these messages into another file (e. g. cron-detail.log).
Documentation links:
- rsyslog.conf: Filter Conditions
- syslog-ng: Filters
Solution 2:
...or you can just be lazy and pipe the logs through grep -v FILTERSTRING ;)
Solution 3:
If I'm thumbing through the log file to make sure my daily backup scripts and such got executed, they get swallowed by all these entries.
Well, system logs like cron.log are not really meant to be thumbed through regularly. If a jobs cannot be run, or produces output on stderr, you will get mail anyway.
If you want positive notification that your cron jobs have run, have the important jobs write a separate logfile, like important.log. Then you get a logfile with exactly the interesting information, in the format you like.