[SOLVED] rsyslog.d conf files are ignored [AUTOSOLVED by MAGIC]

[Tommmii]

EDIT : I went back into syslog, 45 minutes later... all looks as expected... rsyslogd seems to have taken a few minutes before actually using the new conf file.


While trying to discard these log messages :

Oct 18 12:12:00 pvex systemd[1]: Starting Proxmox VE replication runner...
Oct 18 12:12:01 pvex systemd[1]: pvesr.service: Succeeded.
Oct 18 12:12:01 pvex systemd[1]: Started Proxmox VE replication runner.

I have created the file /etc/rsyslog.d/ignore-replication-runner.conf containing :

root@pvex:/etc/rsyslog.d# cat /etc/rsyslog.d/ignore-replication-runner.conf
if $programname == "systemd" and ($msg contains "Starting Proxmox VE replication runner" or $msg contains "Started Proxmox VE replication runner" or $msg contains "pvesr.service: Succeeded") then stop
root@pvex:/etc/rsyslog.d#

I then restarted rsyslog with root@pvex:/etc/rsyslog.d# systemctl restart rsyslog

But, horror :

Oct 18 12:17:11 pvex systemd[1]: Stopping System Logging Service...
Oct 18 12:17:11 pvex rsyslogd[14786]:  [origin software="rsyslogd" swVersion="8.1901.0" x-pid="14786" x-info="https://www.rsyslog.com"] exiting on signal 15.
Oct 18 12:17:11 pvex systemd[1]: rsyslog.service: Succeeded.
Oct 18 12:17:11 pvex systemd[1]: Stopped System Logging Service.
Oct 18 12:17:11 pvex systemd[1]: Starting System Logging Service...
Oct 18 12:17:11 pvex rsyslogd[19634]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd.  [v8.1901.0]
Oct 18 12:17:11 pvex rsyslogd[19634]:  [origin software="rsyslogd" swVersion="8.1901.0" x-pid="19634" x-info="https://www.rsyslog.com"] start
Oct 18 12:17:11 pvex systemd[1]: Started System Logging Service.
Oct 18 12:18:00 pvex systemd[1]: Starting Proxmox VE replication runner...
Oct 18 12:18:01 pvex systemd[1]: pvesr.service: Succeeded.
Oct 18 12:18:01 pvex systemd[1]: Started Proxmox VE replication runner.

What am I missing in this story ?

Spoiler: pveversion -v

root@pvex:/etc/rsyslog.d# pveversion -v
proxmox-ve: 6.2-2 (running kernel: 5.4.65-1-pve)
pve-manager: 6.2-12 (running version: 6.2-12/b287dd27)
pve-kernel-5.4: 6.2-7
pve-kernel-helper: 6.2-7
pve-kernel-5.4.65-1-pve: 5.4.65-1
pve-kernel-5.4.60-1-pve: 5.4.60-2
pve-kernel-5.4.55-1-pve: 5.4.55-1
pve-kernel-5.4.44-2-pve: 5.4.44-2
pve-kernel-5.4.34-1-pve: 5.4.34-2
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.0.4-pve1
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: 0.8.35+pve1
ksm-control-daemon: 1.3-1
libjs-extjs: 6.0.1-10
libknet1: 1.16-pve1
libproxmox-acme-perl: 1.0.5
libpve-access-control: 6.1-3
libpve-apiclient-perl: 3.0-3
libpve-common-perl: 6.2-2
libpve-guest-common-perl: 3.1-3
libpve-http-server-perl: 3.0-6
libpve-storage-perl: 6.2-8
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve4
lxc-pve: 4.0.3-1
lxcfs: 4.0.3-pve3
novnc-pve: 1.1.0-1
proxmox-backup-client: 0.9.0-2
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.3-1
pve-cluster: 6.2-1
pve-container: 3.2-2
pve-docs: 6.2-6
pve-edk2-firmware: 2.20200531-1
pve-firewall: 4.1-3
pve-firmware: 3.1-3
pve-ha-manager: 3.1-1
pve-i18n: 2.2-1
pve-qemu-kvm: 5.1.0-3
pve-xtermjs: 4.7.0-2
qemu-server: 6.2-15
smartmontools: 7.1-pve2
spiceterm: 3.1-1
vncterm: 1.6-2
zfsutils-linux: 0.8.4-pve2

 

[lixaotec]

@Tommmii does it still shows at pve GUI Syslog tab?

I did something similiar with CRON messages, they really disapear from auth.log and syslog, however they still apears at GUI Syslog.

I´m bit confused with that.

 

[RokaKen]

I did something similiar with CRON messages, they really disapear from auth.log and syslog, however they still apears at GUI Syslog.

I´m bit confused with that.

@lixaotec the messages in the GUI {node}>System>Syslog come from systemd-journald.service and unfortunately, there isn't a mechanism to filter those messages. It has been a requested feature for years.

 

[lixaotec]

Dear @RokaKen , thanks for replaying.

In fact I recent found out that behavior.

Is it worth suggest a feature for proxmox team / perhaps I might contribute with a grep filter at proxmox-mini-journalreader.git

 

[RokaKen]

Certainly. I don't have the links, but @t.lamprecht has posted some info/links for doing so in various posts. Feature requests with patches contributed always stand a better chance of success.

 

[robertut]

In theory it has been implemented: https://github.com/systemd/systemd/pull/24058
(doesn't work yet, pve still has systemd 247, while this feature should be in v253).