rsyslog not filtering messages into separate log file

Question

Somehow I can't get this working and I need some help.

I try to filter logs from syslog, written by a systemd service, into a separate log file. Currently I'm using Debian. Here is my rsyslog config located into /etc/rsyslog.d/19-test.conf with content

:msg,contains,"[frontend]"  -/var/log/frontend_app.log

Content of the systemd unit file:

[Service]
    ExecStart=/opt/test/current/venv/bin/python -m api.tasks.frontend_app
    StandardOutput=syslog
    WorkingDirectory=/opt/test/frontend/current
    StandardError=syslog
    User=coco
    ProtectSystem=full
    SyslogIdentifier=[frontend]

Now, when I run the service logs are inserted into syslog but not into /var/log/frontend_app.log but when I try this:

logger -p local1.info "[frontend] test message"

message is inserted OK into /var/log/frontend_app.log.

/etc/rsyslog.conf content:

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#           For more information see
#           /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*             /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info           -/var/log/mail.info
mail.warn           -/var/log/mail.warn
mail.err            /var/log/mail.err

#
# Some "catch-all" log files.
#
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg             :omusrmsg:*

I can't seems to find why it behaves like this and what is the solution for this.

Thx!

Boulware

If you remove your custom rsyslog configuration, do you see the logs appear in /var/log/syslog? That question will help determine whether the problem is getting the logs from systemd->rsyslog or with the rsyslog filtering. – Rikkiriksdag

The logs appear in syslog. In fact I manage to fix it by using :rawmsg instead of :msg. Seems that :msg includes only the message without the SyslogIdentifier while :rawmsg does include it. – Boulware

Answer 1

OK, I managed to fix it by using :rawmsg instead of :msg so,

:rawmsg,contains,"[frontend]"  -/var/log/frontend_app.log

It seems that :msg msg does not contain SyslogIdentifier and only the log message while :rawmsg does include full message with timestamp(if enabled) and SyslogIdentifier.

More info here http://www.rsyslog.com/doc/master/configuration/properties.html#message-properties.

Boulware