logging - 省略将特定日志导出到已配置的远程系统日志服务器

Question

我已成功配置以下内容：

1. 将所有日志导出到远程 rsyslog 服务器的本地计算机。
2. 根据匹配的关键字过滤导出的日志。

现在的问题是过滤后的日志也被丢弃在本地机器上。我希望将其写入 logratate 正在轮换的本地日志文件。

任何已知的解决方案？

当前配置如下：

/etc/rsyslog.d# cat 11-remotesyslog.conf 
##Copy all messages to the remote syslog server at 192.168.0.254 port 514
action(type="omfwd" Target="10.7.159.178" Device="mgmt" Port="514" Protocol="udp")

/etc/rsyslog.d# cat 50-netq-agent.conf 
# The lines below cause netq-agent to log to it's own log
# file, and drops the message so it does not also go to
# /var/log/syslog, so the messages are not duplicated
# netq-agent.log is rotated if it grows to 1MB (logrotate rotates at 500K)
$outchannel netq_agent_log,/var/log/netq-agent.log,1048576,/sbin/rotate_now 
/etc/logrotate.d/netq-agent
if $programname == 'netq-agent' then :omfile:$netq_agent_log
if $programname == 'netq-agent' then stop

/etc/rsyslog.d# cat 98-exporting-filter.conf 
:msg, contains, "Agent is Paused"   stop

/etc/rsyslog.d# cat 99-syslog.conf  | grep -v "#"
$outchannel main_log,/var/log/syslog,4194304,/sbin/rotate_now /etc/logrotate.d/rsyslog
*.*  :omfile:$main_log

提前谢谢你， Ori Acoca

标签： loggingfilterdebianrsyslog