With rsyslog, use something like this near the top of rsyslog.conf.
:msg, contains, "whatever" ~
One minor comment on this.
Use of ~ in rsyslog.conf to suppress is deprecated in recent versions.
If you get warnings, e.g. on RHEL 8 the following error is thrown:
rsyslogd[945534]: warning: ~ action is deprecated, consider using the
'stop' statement instead [v8.1911.0-7.el8 try
https://www.rsyslog.com/e/2307 ],
it will still work, just with the warnings. To remove the warnings use
'stop' instead.
:msg, contains, "whatever" stop
--
Simon Wilson
M: 0400 12 11 16
