Sorry to be gone. It's been a hell of a few days.  What you wrote looks promising. Where can I find more about the sudo-parser and such? That way if the config doesn't work I have an idea of how to tweak it.

Untested config:

log {

    source (s_local);

    if (program("sudo")) {

        parser { sudo-parser(); };

        if (match("auto-user", value(".sudo.USER")) {

            destination (d_autosudo);

    }

    flags(final);

};

I am not entirely sure of the name value pair .sudo.USER, sudo-parser extracts the key=value elements of a sudo log entry, and IIRC the username is an all caps "USER".

On Thu, Feb 4, 2021, 05:48 Dan Egli <dan@newideatest.site> wrote:

Hey folks, I've looked for a way to do this, and I guess my google-foo
is weak today. I've got a situation where on one of my machines, an
automated process FREQUENTLY calls sudo so it can gain the permissions
it needs to do certain tasks. But that means my /var/log/messages is
getting FILLED with sudo messages. I was hoping I could insert some kind
of text filter that would allow me to shunt messages where one user (the
automated process) calls sudo into another log file. It would basically
need to be a nested filter, i.e.:
If message_source = sudo then
     if user = X then
         log to auto_sudo.log

If someone knows how this can be done, I'd appreciate it.

Thanks!
--- Dan

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq