Updated: 28 September 2026 · Applies to: rsyslog 8 on AlmaLinux 9, Rocky Linux 9, Ubuntu 24.04 and Debian 12

rsyslog can drop unwanted messages or send them to a separate file, based on their content or program name.

Examples

Create /etc/rsyslog.d/10-filters.conf:

# discard messages containing this text
:msg, contains, "unwanted text" stop

# send messages from one program to its own file, then stop
:programname, isequal, "myapp" /var/log/myapp.log
& stop

Restart rsyslog: systemctl restart rsyslog. The old ~ discard action still works but stop is the current syntax.

Ucartz services for this topic

Was this answer helpful? 0 Users Found This Useful (0 Votes)