rsyslog filter by tag

I would like to create a rsyslogd config file that filter the syslog for specific tag and outputs this tag to a specific file.

I create a rule file under /etc/rsyslog.d

# Log kernel generated UFW log messages to file :syslogtag, isequal, "ABC" /var/log/ABC.log # Uncomment the following to stop logging anything that matches the last rule. # Doing this will stop logging kernel generated UFW log messages to the file # normally containing kern.* messages (eg, /var/log/kern.log) #& ~ 

The file is created, however the messages with ABC tag still go to the syslog file. How do I do it correctly ?

1 Answer

Your rule file should look like:

:syslogtag, isequal, "ABC:" /var/log/ABC.log 

The syslogtag contains a : and should be enclosed in "".

Also, the file name must be before 50-default.conf in alphabetical order (for example 30-ABC.conf).

Note that the file /var/log/ABC.log should be writable by the 'syslog' user.

Source: how to filer rsyslog messages by tags.