1

My Raspberry PI (running Raspbian Stretch) works 24/7 and many of writings are work in RAM disk (not on SD cards). But there are some unnecessary warnings which are frequently written to log files. I want to skip writing them and I simply can't find what is wrong. I have used this on my previous installations and it works.

For example, if I want to skip "Router Advertisement from", I have in /etc/rsyslog.conf:

:msg, contains, "Router Advertisement from" ~

Instead ~ I have also tried stop and then stop and then ~ but nothing works. And yes, I have restart service (and computer), but strings/warnings are still coming to log file.

Have I missed something?

Aurora0001
  • 6,308
  • 3
  • 23
  • 38
JanezKranjski
  • 141
  • 1
  • 6

1 Answers1

2

The order of the statements in rsyslog.conf is important. If you had a statement in rsyslog.conf that logs everything to /var/log/messages or /var/log/syslog and then placed your filter line after that, you would still see your unwanted entries in /var/log/messages or /var/log/syslog. The order is useful when you want some messages to appear in particular log files but not others.

Also check the status of the rsyslog service to ensure it is running as intended:

systemctl status rsyslog

John Hawthorne
  • 889
  • 5
  • 11
  • Thank you. I know that order of the statements is important and my statements are at the beginning of the file (after comments :-)). I have checked the status. I found something interesting - a warning 'liblogging-stdlog: warning: ~ action is deprecated, consider using the stop statement instead'. I have changed ~ to 'stop', restart rsyslog service, checked again ... and the same warning. Double checked and there is no ~ character in /etc/rsyslog.conf. Does this service uses another configuration file? – JanezKranjski Apr 13 '18 at 16:45
  • 'stop' instead of '~' is the correct syntax but either should work anyway, just that '~' might not work in future. /etc/rsyslog.conf is indeed the correct configuration file. Try a different approach - track down why the messages are there in the first place. Maybe due to partial implementation of ipv6 in which case try adding 'noipv6' to /etc/dhcpcd.conf, then restart the dhcpcd service. – John Hawthorne Apr 13 '18 at 19:34
  • It is true, but there are more messages which are unnecessary in the log. I still don't understand why it still writes those messages. Do you know some other solution? – JanezKranjski Apr 14 '18 at 13:27