on Debian 11 with 5.10.0-19-amd64 is $ rsyslogd -v
Code: Select all
rsyslogd 8.2102.0 (aka 2021.02) compiled with:
PLATFORM: x86_64-pc-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
systemd support: Yes
Config file: /etc/rsyslog.conf
PID file: /run/rsyslogd.pid
Code: Select all
*.* stop
:syslogtag, isequal, "Tor" stop
:programname, isequal, "Tor" stop
sudo systemctl restart rsyslog.service && systemctl status rsyslog.service;date
but it never stop showing Tor log lines in output of "sudo journalctl --since=today|grep tor|grep -v deprecated|tail"
So how to make it not record tor log lines and those containing "bad phrase"?
:msg, contains, "bad phrase" stop
:rawmsg, contains, "bad phrase" ~
no luck
$ sudo grep -v "#" /etc/rsyslog.conf|grep .
Code: Select all
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;\
auth,authpriv.none;\
mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail.none -/var/log/messages
*.emerg :omusrmsg:*
*.* stop
:syslogtag, isequal, "Tor" stop
:programname, isequal, "Tor" stop