Updated: 4 November 2026 · Applies to: rsyslog 8.2x on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13
On a central log server, one noisy device (a switch, a firewall or a misconfigured server) can flood the logs. rsyslog can drop messages from specific IP addresses before they are written anywhere. We checked the rules below with rsyslogd -N1 on AlmaLinux 9 with rsyslog 8.2510.
1. Create a filter file
Create /etc/rsyslog.d/05-drop-hosts.conf. The low number makes rsyslog read it before the files that write logs, so dropped messages never reach them:
# one address if $fromhost-ip == "198.51.100.7" then stop # several addresses if $fromhost-ip == "198.51.100.8" or $fromhost-ip == "198.51.100.9" then stop # a whole network by prefix if $fromhost-ip startswith "10.20." then stop
$fromhost-ip is the address the message arrived from, and stop discards it. The older, shorter syntax :fromhost-ip, isequal, "198.51.100.7" stop still works too.
2. Apply
rsyslogd -N1 systemctl restart rsyslog
Drop only some messages from a host
Keep the host's important messages and drop the noise by combining conditions:
if $fromhost-ip == "198.51.100.7" and $msg contains "link up" then stop if $fromhost-ip == "198.51.100.7" and $syslogseverity > 4 then stop
The second rule drops everything less important than a warning (severity 5 to 7: notice, info, debug) from that host.
Where to put the filter
If your remote logs go through their own ruleset (as in how to send logs to a remote log server), put the if ... then stop lines at the top of that ruleset instead, before the action that writes the files.
Alternative: block at the firewall
To refuse the device completely, block it at the firewall, for example firewall-cmd --permanent --zone=drop --add-source=198.51.100.7. Filtering in rsyslog keeps the connection but discards the messages, which is better when you want to keep some of them.
Official documentation: rsyslog filter conditions and rsyslog properties.
