Mailing List Archive: RSyslog: users

How to stop 'user' facility printing to console

Index | Next | Previous | View Threaded

alexc223 at googlemail

Jan 21, 2012, 9:56 AM

Post #1 of 8 (438 views)
Permalink

How to stop 'user' facility printing to console

Hello,

I have a few web applications that are logging to rsyslog/syslog using
the 'user' facility on Debian 6, which by default is configured to log
these to the file /var/log/user.log

This is working just fine, however these messages are also being
printed to the console of every user that is currently logged in (via
SSH). I'm really struggling to figure out how I can stop this
behaviour. Is it anything to do with the "kernel.printk" level? This
is the current value of it:

$ sysctl kernel.printk
kernel.printk = 7 4 1 7

Kind regards
Alex
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

david at lang

Jan 21, 2012, 6:02 PM

Post #2 of 8 (431 views)
Permalink

Re: How to stop 'user' facility printing to console [In reply to]

On Sat, 21 Jan 2012, Alex Cartwright wrote:

> Hello,
>
> I have a few web applications that are logging to rsyslog/syslog using
> the 'user' facility on Debian 6, which by default is configured to log
> these to the file /var/log/user.log
>
> This is working just fine, however these messages are also being
> printed to the console of every user that is currently logged in (via
> SSH). I'm really struggling to figure out how I can stop this
> behaviour. Is it anything to do with the "kernel.printk" level? This
> is the current value of it:
>
> $ sysctl kernel.printk
> kernel.printk = 7 4 1 7

no, this has nothing to do with the kernel.printk config. probably what is
happening is the severity is set to critical or something like that. We
would need to see your rsyslog.conf (and whatever files it includes) to
find what's configured to be sent to the logged in users.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

alexc223 at googlemail

Jan 22, 2012, 2:24 AM

Post #3 of 8 (431 views)
Permalink

Re: How to stop 'user' facility printing to console [In reply to]

Here is my configuration for rsyslog, https://gist.github.com/1656491

I can see that emergencies are being sent to all users, however that
priority is never used.

Regards,
Alex

On 22 January 2012 02:02, <david [at] lang> wrote:
> On Sat, 21 Jan 2012, Alex Cartwright wrote:
>
>> Hello,
>>
>> I have a few web applications that are logging to rsyslog/syslog using
>> the 'user' facility on Debian 6, which by default is configured to log
>> these to the file /var/log/user.log
>>
>> This is working just fine, however these messages are also being
>> printed to the console of every user that is currently logged in (via
>> SSH). I'm really struggling to figure out how I can stop this
>> behaviour. Is it anything to do with the "kernel.printk" level? This
>> is the current value of it:
>>
>> $ sysctl kernel.printk
>> kernel.printk = 7 4 1 7
>
>
> no, this has nothing to do with the kernel.printk config. probably what is
> happening is the severity is set to critical or something like that. We
> would need to see your rsyslog.conf (and whatever files it includes) to find
> what's configured to be sent to the logged in users.
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

david at lang

Jan 22, 2012, 1:16 PM

Post #4 of 8 (427 views)
Permalink

Re: How to stop 'user' facility printing to console [In reply to]

what priority is being set on th logs that you are seeing for these 'user'
facility logs?

one thing that you can do is to setup a filter to log the types of
messages that you are seeing with the format RSYSLOG_DEBUG so that you can
see the facility, severity, etc that the log messages have.

David Lang

On Sun, 22 Jan 2012, Alex Cartwright wrote:

> Here is my configuration for rsyslog, https://gist.github.com/1656491
>
> I can see that emergencies are being sent to all users, however that
> priority is never used.
>
> Regards,
> Alex
>
> On 22 January 2012 02:02, <david [at] lang> wrote:
>> On Sat, 21 Jan 2012, Alex Cartwright wrote:
>>
>>> Hello,
>>>
>>> I have a few web applications that are logging to rsyslog/syslog using
>>> the 'user' facility on Debian 6, which by default is configured to log
>>> these to the file /var/log/user.log
>>>
>>> This is working just fine, however these messages are also being
>>> printed to the console of every user that is currently logged in (via
>>> SSH). I'm really struggling to figure out how I can stop this
>>> behaviour. Is it anything to do with the "kernel.printk" level? This
>>> is the current value of it:
>>>
>>> $ sysctl kernel.printk
>>> kernel.printk = 7 4 1 7
>>
>>
>> no, this has nothing to do with the kernel.printk config. probably what is
>> happening is the severity is set to critical or something like that. We
>> would need to see your rsyslog.conf (and whatever files it includes) to find
>> what's configured to be sent to the logged in users.
>>
>> David Lang
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
>

alexc223 at gmail

Jan 24, 2012, 8:00 AM

Post #5 of 8 (432 views)
Permalink

Re: How to stop 'user' facility printing to console [In reply to]

This is the output from rsyslog debug: https://gist.github.com/1670748

I think I have found the problem, and it appears to be a bug in the
web app. It is logging with a priority/level of 8, which unless I am
mistaken simply does not exist. However I still can't see where in the
rsyslog.conf that it says to print to the console - can you?

I'll get this fixed up in the app, but at least I've found the problem!

Many thanks,
Alex

On 22 January 2012 21:16, <david [at] lang> wrote:
> what priority is being set on th logs that you are seeing for these 'user'
> facility logs?
>
> one thing that you can do is to setup a filter to log the types of messages
> that you are seeing with the format RSYSLOG_DEBUG so that you can see the
> facility, severity, etc that the log messages have.
>
> David Lang
>
>
> On Sun, 22 Jan 2012, Alex Cartwright wrote:
>
>> Here is my configuration for rsyslog, https://gist.github.com/1656491
>>
>> I can see that emergencies are being sent to all users, however that
>> priority is never used.
>>
>> Regards,
>> Alex
>>
>> On 22 January 2012 02:02, <david [at] lang> wrote:
>>>
>>> On Sat, 21 Jan 2012, Alex Cartwright wrote:
>>>
>>>> Hello,
>>>>
>>>> I have a few web applications that are logging to rsyslog/syslog using
>>>> the 'user' facility on Debian 6, which by default is configured to log
>>>> these to the file /var/log/user.log
>>>>
>>>> This is working just fine, however these messages are also being
>>>> printed to the console of every user that is currently logged in (via
>>>> SSH). I'm really struggling to figure out how I can stop this
>>>> behaviour. Is it anything to do with the "kernel.printk" level? This
>>>> is the current value of it:
>>>>
>>>> $ sysctl kernel.printk
>>>> kernel.printk = 7 4 1 7
>>>
>>>
>>>
>>> no, this has nothing to do with the kernel.printk config. probably what
>>> is
>>> happening is the severity is set to critical or something like that. We
>>> would need to see your rsyslog.conf (and whatever files it includes) to
>>> find
>>> what's configured to be sent to the logged in users.
>>>
>>> David Lang
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

rgerhards at hq

Jan 24, 2012, 8:03 AM

Post #6 of 8 (427 views)
Permalink

Re: How to stop 'user' facility printing to console [In reply to]

Not looked at the debug log, but... 8 is user/emergency, so you have an
emergency message ;)

rainer

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Alex Cartwright
> Sent: Tuesday, January 24, 2012 5:01 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] How to stop 'user' facility printing to console
>
> This is the output from rsyslog debug: https://gist.github.com/1670748
>
> I think I have found the problem, and it appears to be a bug in the
> web app. It is logging with a priority/level of 8, which unless I am
> mistaken simply does not exist. However I still can't see where in the
> rsyslog.conf that it says to print to the console - can you?
>
> I'll get this fixed up in the app, but at least I've found the problem!
>
> Many thanks,
> Alex
>
> On 22 January 2012 21:16, <david [at] lang> wrote:
> > what priority is being set on th logs that you are seeing for these
> 'user'
> > facility logs?
> >
> > one thing that you can do is to setup a filter to log the types of
> messages
> > that you are seeing with the format RSYSLOG_DEBUG so that you can see
> the
> > facility, severity, etc that the log messages have.
> >
> > David Lang
> >
> >
> > On Sun, 22 Jan 2012, Alex Cartwright wrote:
> >
> >> Here is my configuration for rsyslog,
> https://gist.github.com/1656491
> >>
> >> I can see that emergencies are being sent to all users, however that
> >> priority is never used.
> >>
> >> Regards,
> >> Alex
> >>
> >> On 22 January 2012 02:02, <david [at] lang> wrote:
> >>>
> >>> On Sat, 21 Jan 2012, Alex Cartwright wrote:
> >>>
> >>>> Hello,
> >>>>
> >>>> I have a few web applications that are logging to rsyslog/syslog
> using
> >>>> the 'user' facility on Debian 6, which by default is configured to
> log
> >>>> these to the file /var/log/user.log
> >>>>
> >>>> This is working just fine, however these messages are also being
> >>>> printed to the console of every user that is currently logged in
> (via
> >>>> SSH). I'm really struggling to figure out how I can stop this
> >>>> behaviour. Is it anything to do with the "kernel.printk" level?
> This
> >>>> is the current value of it:
> >>>>
> >>>> $ sysctl kernel.printk
> >>>> kernel.printk = 7 4 1 7
> >>>
> >>>
> >>>
> >>> no, this has nothing to do with the kernel.printk config. probably
> what
> >>> is
> >>> happening is the severity is set to critical or something like
> that. We
> >>> would need to see your rsyslog.conf (and whatever files it
> includes) to
> >>> find
> >>> what's configured to be sent to the logged in users.
> >>>
> >>> David Lang
> >>> _______________________________________________
> >>> rsyslog mailing list
> >>> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >>> http://www.rsyslog.com/professional-services/
> >>
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

alexc223 at gmail

Jan 24, 2012, 8:05 AM

Post #7 of 8 (426 views)
Permalink

Re: How to stop 'user' facility printing to console [In reply to]

Excellent, so "*.emerg *" is doing the magic here.

Time to fix the app. Thank you.

Alex

On 24 January 2012 16:03, Rainer Gerhards <rgerhards [at] hq> wrote:
> Not looked at the debug log, but... 8 is user/emergency, so you have an
> emergency message ;)
>
> rainer
>
>> -----Original Message-----
>> From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> bounces [at] lists] On Behalf Of Alex Cartwright
>> Sent: Tuesday, January 24, 2012 5:01 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] How to stop 'user' facility printing to console
>>
>> This is the output from rsyslog debug: https://gist.github.com/1670748
>>
>> I think I have found the problem, and it appears to be a bug in the
>> web app. It is logging with a priority/level of 8, which unless I am
>> mistaken simply does not exist. However I still can't see where in the
>> rsyslog.conf that it says to print to the console - can you?
>>
>> I'll get this fixed up in the app, but at least I've found the problem!
>>
>> Many thanks,
>> Alex
>>
>> On 22 January 2012 21:16, <david [at] lang> wrote:
>> > what priority is being set on th logs that you are seeing for these
>> 'user'
>> > facility logs?
>> >
>> > one thing that you can do is to setup a filter to log the types of
>> messages
>> > that you are seeing with the format RSYSLOG_DEBUG so that you can see
>> the
>> > facility, severity, etc that the log messages have.
>> >
>> > David Lang
>> >
>> >
>> > On Sun, 22 Jan 2012, Alex Cartwright wrote:
>> >
>> >> Here is my configuration for rsyslog,
>> https://gist.github.com/1656491
>> >>
>> >> I can see that emergencies are being sent to all users, however that
>> >> priority is never used.
>> >>
>> >> Regards,
>> >> Alex
>> >>
>> >> On 22 January 2012 02:02, <david [at] lang> wrote:
>> >>>
>> >>> On Sat, 21 Jan 2012, Alex Cartwright wrote:
>> >>>
>> >>>> Hello,
>> >>>>
>> >>>> I have a few web applications that are logging to rsyslog/syslog
>> using
>> >>>> the 'user' facility on Debian 6, which by default is configured to
>> log
>> >>>> these to the file /var/log/user.log
>> >>>>
>> >>>> This is working just fine, however these messages are also being
>> >>>> printed to the console of every user that is currently logged in
>> (via
>> >>>> SSH). I'm really struggling to figure out how I can stop this
>> >>>> behaviour. Is it anything to do with the "kernel.printk" level?
>> This
>> >>>> is the current value of it:
>> >>>>
>> >>>> $ sysctl kernel.printk
>> >>>> kernel.printk = 7 4 1 7
>> >>>
>> >>>
>> >>>
>> >>> no, this has nothing to do with the kernel.printk config. probably
>> what
>> >>> is
>> >>> happening is the severity is set to critical or something like
>> that. We
>> >>> would need to see your rsyslog.conf (and whatever files it
>> includes) to
>> >>> find
>> >>> what's configured to be sent to the logged in users.
>> >>>
>> >>> David Lang
>> >>> _______________________________________________
>> >>> rsyslog mailing list
>> >>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> >>> http://www.rsyslog.com/professional-services/
>> >>
>> >> _______________________________________________
>> >> rsyslog mailing list
>> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> >> http://www.rsyslog.com/professional-services/
>> >
>> >
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> >
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

rgerhards at hq

Jan 24, 2012, 8:06 AM

Post #8 of 8 (427 views)
Permalink

Re: How to stop 'user' facility printing to console [In reply to]

Yup, think so.

rg

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Alex Cartwright
> Sent: Tuesday, January 24, 2012 5:05 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] How to stop 'user' facility printing to console
>
> Excellent, so "*.emerg *" is doing the magic
> here.
>
> Time to fix the app. Thank you.
>
> Alex
>
> On 24 January 2012 16:03, Rainer Gerhards <rgerhards [at] hq>
> wrote:
> > Not looked at the debug log, but... 8 is user/emergency, so you have
> an
> > emergency message ;)
> >
> > rainer
> >
> >> -----Original Message-----
> >> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> bounces [at] lists] On Behalf Of Alex Cartwright
> >> Sent: Tuesday, January 24, 2012 5:01 PM
> >> To: rsyslog-users
> >> Subject: Re: [rsyslog] How to stop 'user' facility printing to
> console
> >>
> >> This is the output from rsyslog debug:
> https://gist.github.com/1670748
> >>
> >> I think I have found the problem, and it appears to be a bug in the
> >> web app. It is logging with a priority/level of 8, which unless I am
> >> mistaken simply does not exist. However I still can't see where in
> the
> >> rsyslog.conf that it says to print to the console - can you?
> >>
> >> I'll get this fixed up in the app, but at least I've found the
> problem!
> >>
> >> Many thanks,
> >> Alex
> >>
> >> On 22 January 2012 21:16, <david [at] lang> wrote:
> >> > what priority is being set on th logs that you are seeing for
> these
> >> 'user'
> >> > facility logs?
> >> >
> >> > one thing that you can do is to setup a filter to log the types of
> >> messages
> >> > that you are seeing with the format RSYSLOG_DEBUG so that you can
> see
> >> the
> >> > facility, severity, etc that the log messages have.
> >> >
> >> > David Lang
> >> >
> >> >
> >> > On Sun, 22 Jan 2012, Alex Cartwright wrote:
> >> >
> >> >> Here is my configuration for rsyslog,
> >> https://gist.github.com/1656491
> >> >>
> >> >> I can see that emergencies are being sent to all users, however
> that
> >> >> priority is never used.
> >> >>
> >> >> Regards,
> >> >> Alex
> >> >>
> >> >> On 22 January 2012 02:02, <david [at] lang> wrote:
> >> >>>
> >> >>> On Sat, 21 Jan 2012, Alex Cartwright wrote:
> >> >>>
> >> >>>> Hello,
> >> >>>>
> >> >>>> I have a few web applications that are logging to
> rsyslog/syslog
> >> using
> >> >>>> the 'user' facility on Debian 6, which by default is configured
> to
> >> log
> >> >>>> these to the file /var/log/user.log
> >> >>>>
> >> >>>> This is working just fine, however these messages are also
> being
> >> >>>> printed to the console of every user that is currently logged
> in
> >> (via
> >> >>>> SSH). I'm really struggling to figure out how I can stop this
> >> >>>> behaviour. Is it anything to do with the "kernel.printk" level?
> >> This
> >> >>>> is the current value of it:
> >> >>>>
> >> >>>> $ sysctl kernel.printk
> >> >>>> kernel.printk = 7 4 1 7
> >> >>>
> >> >>>
> >> >>>
> >> >>> no, this has nothing to do with the kernel.printk config.
> probably
> >> what
> >> >>> is
> >> >>> happening is the severity is set to critical or something like
> >> that. We
> >> >>> would need to see your rsyslog.conf (and whatever files it
> >> includes) to
> >> >>> find
> >> >>> what's configured to be sent to the logged in users.
> >> >>>
> >> >>> David Lang
> >> >>> _______________________________________________
> >> >>> rsyslog mailing list
> >> >>> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> >>> http://www.rsyslog.com/professional-services/
> >> >>
> >> >> _______________________________________________
> >> >> rsyslog mailing list
> >> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> >> http://www.rsyslog.com/professional-services/
> >> >
> >> >
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> >
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads