Open Stack

Hi guys,

We want to be able to forward nova-compute's log to a central rsyslog but
at the same time mantain the local "/var/log/nova/nova-compute.log". In
Icehouse we achieved this with the following configuration in
"/etc/rsyslog.d/60-nova.conf":

*.*;local0.none,auth,authpriv.none   -/var/log/syslog
local0.*                 @@10.161.0.1:1024
local0.*                 /var/log/nova/nova-compute.log


We also had to comment this line in "/etc/rsyslog.d/50-default.conf"
(reference: https://www.osso.nl/blog/rsyslog-cron-deleting-rules)

*.*;auth,authpriv.none   -/var/log/syslog


Now, in Mitaka / Ubuntu 16 / systemd, with this same configuration, we are
getting duplicate logs: every line goes to /var/log/syslog and
/var/log/nova/nova-compute.log

We want to only log in nova-compute.log

Maybe this is because systemd is forwarding everything to rsyslog? By
default, /etc/systemd/journald.conf has "ForwardToSyslog=yes"

thanks!
Gustavo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-operators/attachments/20160809/49622458/attachment.html>