rsyslog udp traffic with filter

Created Wed Apr, 21 2021 at 04:58AM

I was setting up an rsyslog conf for remote UDP traffic filtering kern.debug messages, example below:

$ModLoad imudp.so
$UDPServerRun 514

kern.debug
:msg, contains, "foo" /var/log/foo.log
:msg, contains, "bar" /var/log/bar.log
& stop

and a complementing logrotate

/etc/logrotate.d/foo

/etc/logrotate.d ยป cat netlogger
/var/log/foo/*.log
{
  rotate 14
  daily
  missingok
  notifempty
  delaycompress
  compress
}