rsyslog, log msgs in a different file

[Karl Auer]

On Sat, 2024-02-17 at 23:44 -0700, R C wrote:
> I have the impression it is an "order thing",  a rule gets applied,  
> rsyslog thinks it is done and never applies the rule I wrote.

It is most definitely an "order thing", unless your filters say
otherwise.

Put your stanza in a file in /etc/rsyslog.conf with a two-digit prefix
so it sorts before the default rules and see if you get any further. If
you are adding it to the end of the main file, all the default stuff
will happen before your stuff gets a go. Mind you, nearly all the
default stuff is commented out, at least on my system (20.04LTS).

I don't see anything in the default stuff that has a "stop", on it so
unless the old selectors imply a stop, that's a puzzle too...

For debugging, you might like to investigate the "logger" utility,
which lets you send hand-crafted stuff to syslog while specifying
pretty much every aspect of the entry. Combine it with the debug mode
of rsyslogd (-d) maybe.

Regards, K.

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer at biplane.com.au)
http://www.biplane.com.au/kauer