Table of Contents

rsyslog
- Filtering Applications into their own Logfiles
- Filtering CRON into its own Logfile

rsyslog

Filtering Applications into their own Logfiles

Create a file in /etc/rsyslog.d/ with the following syntax

if $programname == '<programname' then <logfile>
& ~

For example for tftpd you may write:

if $programname == 'in.tftpd' then /var/log/tftpd.log
& ~

The programname variable can be found it the output to syslog. (e.g. see in.tftpd in the line below)

Jan 17 23:32:54 zoidberg in.tftpd[12343]:

Filtering CRON into its own Logfile

Open /etc/rsyslogd.conf

| *.*;auth,authpriv.none             -/var/log/syslog
| #cron.*                            /var/log/cron.log

and change it to

| *.*;auth,authpriv.none,cron.none   -/var/log/syslog
| cron.*                             -/var/log/cron/cron.log