rsyslog: Log some messages only to specific file

Question

My firewall logs get written to my custom iptables.log file, but also to kern.log, messages, and syslog. I don't want these messages duplicated in all these logs.

What is wrong with my config?

$ cat /etc/rsyslog.d/iptables.conf

# This works, and the messages do get to iptables.log.
:msg, regex,  "^\[ *[0-9]*\.[0-9]*\] IPT" -/var/log/iptables.log
& ~

In /etc/rsyslog.conf, $IncludeConfig /etc/rsyslog.d/*.conf is called before the lines for the standard log files:

$ cat /etc/rsyslog.conf

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log
mail.info           -/var/log/mail.info
mail.warn           -/var/log/mail.warn
mail.err            /var/log/mail.err
news.crit           /var/log/news/news.crit
news.err            /var/log/news/news.err
news.notice         -/var/log/news/news.notice
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages
*.emerg             :omusrmsg:*
daemon.*;mail.*;\
    news.err;\
    *.=debug;*.=info;\
    *.=notice;*.=warn   |/dev/xconsole

This is on a Debian Wheezy (7.9) system, with rsyslog version 5.8.11-3+deb7u2

Solution

Your $IncludeConfig /etc/rsyslog.d/*.conf is above the rest of the logs, so all you need to do is stop processing lines in your iptables.conf. The & ~ already says "stop processing", but on some systems I found you need stop instead. And only the stop seems to be in the manual

Comments

[Admin]

There is a very similar question at unix.stackexchange.com/questions/8737/… but that didn't help me.

[mivk]

stop didn't work on my system, but removing the space from & ~ did. So apparently, on some systems you need stop and on others you need &~. Very annoying...