This is somewhat related to my previous question here.I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf:00-iptables.conf50-default.confpostfix.confThe first one is one that I created. My assumption is/was, that due to the naming it will be included before 50-default.conf, but I also tried putting the filter lines directly into 50-default.conf and remove my custom file (00-iptables.conf).:msg, startswith, ipt: /var/log/iptables.log& stopReplaced ~ with stop as running rsyslogd with -N1 as described on the man page and in the troubleshooting steps gave a warning, saying ~ is deprecated in favor or stop, which means the available (official!) documentation seems to be outdated/lagging behind.Now the idea here is that any message prefixed with ipt: will go into the named log file and no other log file will receive these lines (I tried also contains instead of startswith). That is in particular syslog and kern.log mentioned in 50-default.conf shouldn't receive those messages anymore:auth,authpriv.*            /var/log/auth.log*.*;auth,authpriv.none     -/var/log/syslogkern.*                     -/var/log/kern.logI read the rsyslog documentation, but documentation for the property-based filters (also here) isn't exactly the most enlightening.The example given in the documentation (also found elsewhere) and their Wiki gives a similar example:# From documentation*.* /var/log/allmsgs-including-informational.log:msg, contains, informational  ~*.* /var/log/allmsgs-but-informational.log# From Wiki:syslogtag, startswith, MSWinEventLog#011 /var/log/messages;fixsnareFormat& @192.168.1.8;fixsnareForwardFormat& ~While the example from the documentation isn't as close to my two-liner, it still explains the meaning of the ~ better.What am I doing wrong?Bonus points if someone can answer whether there is a way to combine selectors and properties. E.g.::msg, startswith, ipt: kern.* /var/log/iptables.logNB: I use version 7.4.4 of rsyslog. And yes, I did service rsyslog restart after the changes and then waited for it to take effect.EditSome more info. When running the daemon in debug mode (RSYSLOG_DEBUG=LogFuncFlow RSYSLOG_DEBUGLOG=~/rsl.log $(which rsyslogd) -f /etc/rsyslog.conf -d), I can see that the ruleset after optimization looks like this, which seems to indicate it's exactly the way I want it (leading prefix stripped for brevity):ruleset 'RSYSLOG_DefaultRuleset' after optimization:ruleset 0x214a640: rsyslog ruleset RSYSLOG_DefaultRuleset:PROPFILT   Property.: 'rawmsg'   Operation: 'contains'   Value....: 'ipt:'THEN  ACTION 0x215c070 [builtin:omfile:/var/log/iptables.log]  STOPEND PROPFILTPRIFILT 'auth,authpriv.*'pmask:  X  X  X  X FF  X  X  X  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X  ACTION 0x215e840 [builtin:omfile:/var/log/auth.log]END PRIFILTPRIFILT '*.*;auth,authpriv.none'pmask: FF FF FF FF  X FF FF FF FF FF  X FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ACTION 0x215f030 [builtin:omfile:-/var/log/syslog]END PRIFILTI should also add that from the behavior I see, I can deduce that the filter has an effect, as it clearly writes into the file /var/log/iptables.log as expected. However, the messages aren't dropped as expected after writing them to that particular file.Here's an example line the way it ends up in all of kern.log, syslog and iptables.log as opposed to only the latter. Details have been redacted for privacy reasons:Jun  1 02:23:01 hostname kernel: [70025.211497] ipt:drop IN=eth0 OUT=virbr0 MAC=dd:cc:bb:aa:99:88:77:66:55:44:33:22:11:00 SRC=9.8.7.6 DST=1.2.3.4 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=59201 DF PROTO=TCP SPT=47626 DPT=23 WINDOW=4380 RES=0x00 SYN URGP=0
Why does rsyslogd not honor the following lines in rsyslog.d
configuration;syslog;rsyslog