Write one application’s syslog messages to a separate file

In rsyslog, match the application's $programname, write it with an omfile action, and use stop if later rules should not also handle the message. The application must already send events into rsyslog; this rule does not read an arbitrary application log file.

Confirm the application's identifier

Inspect an existing event in /var/log/syslog, /var/log/messages, or your distribution's logging destination. $programname is the parsed program portion of the syslog tag, usually excluding a PID suffix such as [1234]. Do not assume it is identical to the application's package or service name.

For a controlled Linux test, set a tag explicitly:

logger -t myapp "Dedicated log routing check"

Add an early routing rule

If the main configuration includes /etc/rsyslog.d/*.conf, create a file such as /etc/rsyslog.d/10-myapp.conf:

if $programname == "myapp" then {
  action(type="omfile"
         file="/var/log/myapp.log"
         fileCreateMode="0640")
  stop
}

Check the actual include position and rule ordering. A numeric prefix alone does not guarantee that the rule precedes the distribution's default outputs. stop prevents subsequent processing; it cannot remove a copy already written by an earlier action. Omit it when both the dedicated file and later destinations are intentional.

Make the destination writable

The correct owner and group depend on the rsyslog service's privileges. On a system that uses syslog:adm, an existing file can be prepared as follows:

sudo touch /var/log/myapp.log
sudo chown syslog:adm /var/log/myapp.log
sudo chmod 0640 /var/log/myapp.log

Use the accounts appropriate to your distribution. fileCreateMode affects newly created files; it does not repair ownership or permissions on an existing file. Check parent directories and SELinux/AppArmor rules too. Configure rotation to preserve the intended permissions.

Validate and follow a test event

sudo rsyslogd -N1
sudo systemctl restart rsyslog
logger -t myapp "Dedicated log routing check"
sudo tail /var/log/myapp.log

Inspect the service log if the file stays empty. Verify the application's real tag, which input receives it, and whether an earlier stop consumes it.

If Guance collects these logs, update the file path in DataKit log collection and confirm a new test event reaches Guance. A successful local write does not update an existing collector configuration automatically.

FAQ

Why is there still a copy in syslog?

The dedicated rule may run after a general file output, or another collector may be reading the same source. Inspect the complete route rather than merely adding another stop.

Can I select other properties?

Yes: hostname, facility, or message contents are common choices. $msg contains "ERROR" is a substring test, not a regex. For several applications, use separate conditions and output paths, ensuring an early stop does not suppress a later intended destination.

References: rsyslog properties and file output.