Home / server / Questions / 354864
Accepted
Thermionix
Asked: 2012-01-30 16:34:42 +0800 CST

snoopy rsyslog output file rule

  • 772

I'm just setting up snoopy logger on my personal machine to archive commands I've run.

I'm attempting to setup an rsyslog rule to move its messages from /var/log/auth.log to /var/log/snoopy.log

I've tried a few different rsyslog rules to move the output, but after resetting the rsyslog service it's still logging to auth.log

~$ cat /etc/rsyslog.d/snoopy.conf

#if $programname == 'snoopy' then /var/log/snoopy.log
#& ~
:programname, isequal, "snoopy" /var/log/snoopy.log

Could it be that the rule in /etc/rsyslog.d/50-default.conf

auth,authpriv.* /var/log/auth.log

Is overriding any rule I specify?

logging rsyslog

1 Answers

  1. Best Answer

    I renamed the file such that it was loaded earlier than the auth rule, and added & ~ to stop messages that match this rule being used in other rules.

    ~$ cat /etc/rsyslog.d/10-snoopy.conf

    :programname, isequal, "snoopy" /var/log/snoopy.log
& ~
    • 1