Home / server / Questions / 549645
In Process
Brian
Asked: 2013-10-31 05:39:08 +0800 CST

rsyslog forward all except ldap

  • 772

I have Centos 6 servers running openLDAP. In the rsyslog.conf, I forward the logs to my central server with this line:

*.*    @10.10.10.10:514

openldap seems incredibly chatty. I have 3 servers in a multi-master cluster. Those 3 servers generate twice as many logs as my other 80 servers combined.

I have been unsuccessful in figuring out how to tell openLDAP to use a sensible log level. (we never specifically set the log level) Since these are my main authentication sources, I'm a bit hesitant to "play around" with them. Is there a way to tell rsyslog to forward everything EXCEPT LOCAL4?

centos6

1 Answers

  1. I discovered the solution. OpenLDAP uses the syslog facility LOCAL4 by default, and in my centos6 servers, that is not defined.

    However, I have the 

    *.*      @10.10.10.10:514

    which includes local4, which was not defined elsewhere.

    In order to specifically exclude (I noticed this on the line that deals with /var/log/messages) I can just do this:

    *.*;local4.none         @10.10.10.10:514

    I could also combine this with others, like:

    *.*;local4.none;mail.debug;local7.error           @10.10.10.10:514

    In the above, it appears from my testing that forwards everything, except local4, or anything "below" debug on mail, or error on local7

    This appears to keep my logstash data much, much clearer.

    • 1