By Trevor Eaton Cordes
License: Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)

Now we can make our rules.


edit rsyslog.conf (take out the \+NLs):

==================

# TEC shutup php stupid new warnings
if $syslogtag == 'php:' and $msg startswith \
" PHP Warning:  Undefined array key"                                        then stop

if $syslogtag == 'php:' and $msg startswith \
" PHP Warning:  Undefined variable"                                         then stop

if $syslogtag == 'php:' and $msg startswith \
" PHP Warning:  Trying to access array offset on value of type null"        then stop

if $syslogtag == 'php:' then /var/log/php-fpm/www-error.log
& stop

==================



stop means cease processing all rules if this matches.

& stop means "if the previous line matched then stop".



Guessing on optimizations:

Matching whole (short) tag should be less compute-intensive than msg, and "=="
better than "contains" or "startswith".

Using startswith better than contains, and possible when you know the initial-space
trick.
